include:spf.protection.outlook.com – Microsoft 365 / Exchange Online
Short answer: include:spf.protection.outlook.com lets Microsoft 365 / Exchange Online's mail servers pass SPF for your domain. It costs 1 of the 10 DNS lookups SPF allows (checked live).
| Service | Microsoft 365 / Exchange Online |
|---|---|
| Lookups | 1 of the 10 DNS lookups SPF allows (checked live) |
| Record now | v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all |
Do you need it?
Yes, if you send mail through Microsoft 365 / Exchange Online with your own domain. It is the include our Microsoft 365 setup guide uses. One include covers Exchange Online. Microsoft recommends -all once every sender is listed.
Who uses it
In our scan of top websites on 23 Oct 2026:
- 329 of the 2,214 world's top-3,000 sites that publish SPF (14.9%)
- 304 of the 1,961 India's top-3,000 sites that publish SPF (15.5%)
- 13 of the 428 Indian government sites that publish SPF (3.0%)
Add it the right way
- Keep one SPF record per domain:
v=spf1 include:spf.protection.outlook.com ~all, plus your other senders in the same record – SPF generator. - Stay under 10 lookups in total; every include counts, nested ones too.
- SPF alone isn't enough for Gmail, Yahoo and Outlook: turn on DKIM and publish DMARC.
Check your domain
After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.
Get it fixed on Fiverr
Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.