SPF, DKIM and DMARC for Microsoft 365

The DNS records Microsoft 365 needs so your mail is authenticated and stays out of spam.

SPF	TXT at `@`	v=spf1 include:spf.protection.outlook.com ~all One include covers Exchange Online. Microsoft recommends `-all` once every sender is listed. Combine with your other senders →
DKIM	CNAME / TXT	Two CNAME records, `selector1._domainkey` and `selector2._domainkey`, pointing to the targets shown in the Microsoft Defender portal.
DMARC	TXT at `_dmarc`	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Start with `p=none` and a mailbox you read; build your own.

Step by step

Add the SPF record below at @ (or add include:spf.protection.outlook.com to your existing one).
Open the Microsoft Defender portal at security.microsoft.com → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM and select your domain.
Copy the two CNAME records it shows. New tenants get targets like selector1-yourdomain-com._domainkey.yourtenant.n-v1.dkim.mail.microsoft; older tenants end in .onmicrosoft.com. Use exactly what your portal shows.
After both CNAMEs resolve, switch Sign messages for this domain with DKIM signatures to Enabled.
Publish DMARC with p=none and tighten it once the reports are clean.

Without custom DKIM, Microsoft signs with your onmicrosoft.com domain, so DKIM never aligns with your From address.
Microsoft 365 bought through GoDaddy is often federated: the DKIM switch can be hidden. Use the Defender portal link above or ask GoDaddy support to enable it.
If a CNAME gets proxied by your DNS host (Cloudflare's orange cloud), DKIM will not validate: keep these records DNS-only.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.