Set up SPF first, then DKIM, then DMARC. Start DMARC at p=none, read the reports, and move to enforcement in stages so you stop spoofing without blocking your own mail.
Key Takeaways
- Microsoft recommends this order: SPF, then DKIM, then DMARC.
- Start at p=none to collect reports, then move to quarantine and reject once your legitimate senders pass.
- Every service that sends as your domain needs to be accounted for, not just Microsoft 365.
Step 1: List everything that sends as your domain
Include Microsoft 365, your marketing and CRM tools, support desk, billing system, and anything on a website or server that sends mail. This is the step people skip, and it’s the usual reason DMARC enforcement breaks legitimate mail.
Step 2: Set up SPF
Publish one SPF TXT record at the root of your domain. If Microsoft 365 is your only sender, it looks like this:
v=spf1 include:spf.protection.outlook.com -all
Add your other senders to the same record. A domain should have only one SPF record, and SPF allows no more than 10 DNS lookups, so a long list of services can break it.
Step 3: Turn on DKIM
In the Microsoft Defender portal, go to the email authentication settings and select the DKIM tab, then your domain. Microsoft shows you two CNAME records, named selector1._domainkey and selector2._domainkey. Copy the exact values it gives you, publish them at your DNS host, wait for them to propagate, and enable signing.
Set up DKIM with your other sending services too, using your own domain. DKIM is often easier than SPF for third-party senders to align with your From address.
Step 4: Publish DMARC at p=none
Add a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
At p=none, nothing changes for delivery. Mail providers just start sending daily reports to the address you’ve listed. Note that p=none doesn’t stop spoofing. It’s a place to start, not a place to stay.
Step 5: Read the reports and fix failures
Reports arrive as XML, which is hard to read by hand, so most teams use a DMARC monitoring service. Look for legitimate senders failing SPF or DKIM alignment, fix each one, and keep watching until only unknown or malicious senders are failing. Allow enough time to catch mail that goes out only monthly or quarterly, such as invoices.
Step 6: Move to enforcement in stages
Change the policy to p=quarantine, which sends failing mail to spam, and watch the reports. You can use the pct tag to apply it to a portion of mail first, though mailbox providers may treat it differently in practice. Once everything is stable, move to p=reject, which tells receivers to refuse failing mail.
Our own domain publishes p=reject with strict alignment, and you can look it up at _dmarc.intragreat.com.
Don’t forget your other domains
Your onmicrosoft.com domain has SPF and DKIM set up by Microsoft, but it needs its own DMARC record if you send from it. Domains you own but never send from should also be protected, with an SPF record of v=spf1 -all and a DMARC policy of p=reject.