{"id":17212,"date":"2024-11-21T11:33:00","date_gmt":"2024-11-21T11:33:00","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=17212"},"modified":"2025-09-22T14:59:55","modified_gmt":"2025-09-22T14:59:55","slug":"microsoft-365-spf-and-dkim-configuration-step-by-step","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/microsoft-365-spf-and-dkim-configuration-step-by-step\/","title":{"rendered":"Microsoft 365 SPF and DKIM Configuration: Step by Step"},"content":{"rendered":"\n

Our informative post will help you find out how you can setup <\/span>Sender Policy Framework (SPF)<\/span><\/a>, DomainKeys Identified Mail (DKIM) Signatures on your Microsoft 365 email to eliminate spam from your domain and increase security.<\/span><\/p>\n\n\n\n

Microsoft requires you to configure the following DNS records for your domain: Microsoft 365 SPF(previously called o365 spf record) and DKIM.<\/span><\/p>\n\n\n\n

SPF records<\/a> allow receiving servers to check whether an email with the specified source domain was actually sent from a server authorized by the owner of this domain.<\/span><\/p>\n\n\n\n

DKIM adds a digital signature to each message. This allows the receiving server to check if the message has been sent from an authorized sender, faked or changed upon delivery.<\/span><\/p>\n\n\n\n

<\/div>\n\n\n\n

Microsoft 365 (o365) SPF Record Configuration<\/b><\/h2>\n\n\n\n

In order to authorize Microsoft 365 to send emails on your domain behalf, you will need to create or update your SPF Record which includes the following mechanism: include:spf.protection.outlook.com <\/span><\/p>\n\n\n\n

You can achieve this easily with our <\/span>SPF Record Generator<\/span><\/a> tool; here are the steps:<\/span><\/p>\n\n\n\n

Step 1:<\/b> Generate a new Microsoft <\/span>office 365 SPF Record<\/b><\/p>\n\n\n

\n
\"SPF-For-Microsoft365-Office365-EasyDMARC\"<\/figure>\n<\/div>\n\n\n\n\n\n\n

Step 2: <\/b>Copy the newly generated <\/span>office 365 SPF Record<\/b><\/p>\n\n\n\n

Step 3:<\/b> Update your DNS TXT Record for SPF at your domain provider (We will show examples with GoDaddy and Cloudflare)<\/span><\/p>\n\n\n\n

E.g GoDaddy<\/span><\/p>\n\n\n

\n
\"SPF-For-Microsoft365-Office365-EasyDMARC-GoDaddy-TXT\"<\/figure>\n<\/div>\n\n\n\n\n\n\n

E.g Cloudflare<\/span><\/p>\n\n\n

\n
\"SPF-For-Microsoft365-Office365-EasyDMARC-Cloudflare-TXT\"<\/figure>\n<\/div>\n\n\n\n\n\n\n

Step 4: <\/b>Click Save<\/span><\/p>\n\n\n\n

Important Note: Make sure you don\u2019t create <\/span>multiple SPF TXT records for office 365<\/b> on one domain. If you do, SPF will return a PermError.<\/span><\/p>\n\n\n\n

If you are using multiple IPs, ESPs, Third-Party services for your various email strategies, you should include them in a single SPF Record.<\/span><\/p>\n\n\n\n

E.g v=spf1 ip4:17.67.137.221 include:spf.protection.outlook.com include:thirdpartyservice.com ~all<\/span><\/p>\n\n\n\n

\n
<\/div>\n<\/div>\n\n\n\n

Microsoft 365 DKIM Configuration<\/b><\/h2>\n\n\n\n

Step 1:<\/b> Go to the DKIM Page from your Microsoft 365 Defender portal <\/span>https:\/\/security.microsoft.com\/dkimv2<\/span><\/a><\/p>\n\n\n\n

Step 2:<\/b> Next, select your organizational domain name, and click \u201cEnable\u201d.<\/span><\/p>\n\n\n\n

\"b68668a9fdaeb8d38c96b16fb57653a4\"<\/figure>\n\n\n\n\n\n\n\n

Step 3:<\/b> Once you click on the \u201cEnable\u201d, a new pop up window will appear with the applicable CNAME Records.<\/span><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n\n\n\n\n

To summarize, this contains 2 separate CNAME Records which looks like this:<\/span><\/p>\n\n\n\n

    \n
  1. Type: <\/span><\/i>CNAME<\/span>
    Host Name: <\/span><\/i>selector1._domainkey<\/span>
    Value: <\/span><\/i>selector1-yourdomain-com._domainkey.tenantdomain.y-v1.dkim.mail.microsoft (This part is UNIQUE to each domain)<\/span><\/li>\n\n\n\n
  2. Type:<\/span><\/i> CNAME
    <\/span>Host Name:<\/span><\/i> selector2._domainkey
    <\/span>Value:<\/span><\/i> selector2-yourdomain-com._domainkey.tenantdomain.y-v1.dkim.mail.microsoft<\/span> (This part is UNIQUE to each domain)<\/span><\/li>\n<\/ol>\n\n\n\n

    Step 4:<\/b> Copy these 2 CNAME Values and paste them in your DNS Provider (In this example, we\u2019ll be using CloudFlare)<\/span><\/p>\n\n\n\n

    1st CNAME:<\/b>
    \"4c5d33a4d9a5645aaf3dd398e8341d29\"<\/p>\n\n\n\n

    2nd CNAME:<\/b><\/p>\n\n\n\n

    \"\"
    Step 5: <\/b>Once the 2 CNAME Records are implemented in your DNS, go back to your Microsoft 365 Defender portal and re-click the \u201cEnable\u201d button. If everything has been configured correctly, you’ll get to see the green check with the \u201cEnabled\u201d notification.<\/span><\/p>\n\n\n\n

    \"9d4389efb6dc71582831cf4694e35ca7\"<\/figure>\n\n\n\n

    Important note: <\/strong>If the provider recommends publishing also a DMARC record, there\u2019s no need to do so if you already have a DMARC record in place, as each domain can only have one DMARC record.<\/p>\n\n\n\n\n\n\n\n

    Congrats, you now successfully authenticated your outgoing mail stream from Office 365 with SPF and DKIM.<\/span><\/p>\n\n\n\n

    \n