SPF, DKIM and DMARC for Microsoft 365: the exact records

1. SPF

Add (or edit) the single TXT record at your domain root that starts with v=spf1 so it reads: v=spf1 include:spf.protection.outlook.com ~all

If other services send email as you — a newsletter tool, a shop, invoicing — add their include to the same record. A domain must have only one SPF record.

2. DKIM

In the Microsoft Defender portal, open Email & collaboration → Policies → Email authentication settings → DKIM, choose your domain, add the two CNAME records it shows, then turn signing on.

Microsoft 365 publishes DKIM through two CNAME records (selector1 and selector2) that point to keys Microsoft rotates for you; both must exist before signing can be turned on.

3. DMARC

Add a TXT record named _dmarc with v=DMARC1; p=none; rua=mailto:you@yourdomain.com, using a mailbox that exists. Read the daily reports for two to four weeks, then change p=none to p=quarantine so forged mail goes to spam.

Where to add the records

Menu names change, but these are the usual paths:

• GoDaddy: Sign in to GoDaddy → your domain → DNS → Add New Record.
• Cloudflare: Cloudflare dashboard → your domain → DNS → Records → Add record.
• Squarespace: Squarespace → Domains → your domain → DNS → DNS Settings → Add record.
• Namecheap: Namecheap → Domain List → Manage → Advanced DNS → Add New Record.
• IONOS: IONOS → Domains & SSL → your domain → DNS → Add record.
• STRATO: STRATO → Domains → Manage domain → DNS → manage the TXT and CNAME records.
• Wix: Wix → Domains → ⋯ next to your domain → Manage DNS Records → Add record.
• Hostinger: Hostinger hPanel → Domains → Manage → DNS / Nameservers → add a record.
• Amazon Route 53: AWS console → Route 53 → Hosted zones → your domain → Create record.
• Vercel: Vercel → Domains → your domain → DNS Records → Add.
• Hetzner: Hetzner DNS console → your zone → Add record.