Microsoft 365: stop your emails going to spam
Three records, in this order. Each step links to Microsoft 365's own instructions. Re-run the check and test email when you're done.
1. SPF
Add (or edit) the TXT record on your domain's root name:
v=spf1 include:spf.protection.outlook.com -all
Only one SPF record per domain. If other tools also send for you (a CRM, a newsletter service), build the combined record rather than adding a second one.
Microsoft: Set up SPF · checked Oct 2026
2. DKIM
- In the Microsoft 365 Defender portal open Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
- Select your domain. Microsoft shows two CNAME records (selector1._domainkey and selector2._domainkey) pointing at onmicrosoft.com names.
- Add both CNAMEs in your DNS, then return and switch Sign messages for this domain with DKIM signatures to Enabled.
Microsoft: Set up DKIM · checked Oct 2026
3. DMARC
Add a TXT record named _dmarc with this starter value, replacing the address with one you read:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
p=none only monitors. After a few weeks of clean reports, change it to p=quarantine, then p=reject.