Understanding Microsoft 365 / Office 365 (Exchange Online) Email Authentication
Microsoft 365 Exchange Online enforces dual-selector CNAME-based DKIM rotation (selector1 and selector2) and requires SPF authorization via "include:spf.protection.outlook.com".
When Microsoft 365 / Office 365 (Exchange Online) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Microsoft 365 / Office 365 (Exchange Online)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Microsoft 365
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:spf.protection.outlook.com -all | 3600 | Authorizes Exchange Online sending servers. |
| CNAME | selector1._domainkey | selector1-domain-com._domainkey.domain.onmicrosoft.com | 3600 | Primary DKIM endpoint. |
| CNAME | selector2._domainkey | selector2-domain-com._domainkey.domain.onmicrosoft.com | 3600 | Secondary DKIM endpoint. |
Step-by-Step Setup Instructions
Open DNS Zone Editor for your domain.
Add "include:spf.protection.outlook.com" to your existing root SPF TXT record.
Go to Microsoft Defender portal > Threat Policies > DKIM.
Add both CNAME records (selector1 and selector2) pointing to your ".onmicrosoft.com" endpoint.
Enable DKIM signing in Microsoft Defender.
Common Microsoft 365 SPF Configuration Mistakes
× DKIM Toggle Fails in Admin
Cause: Attempting to toggle before CNAMEs propagate.
Fix: Wait 15 minutes and retry.
Frequently Asked Questions
Why does Microsoft 365 use two DKIM selectors?
To support automatic cryptographic key rotation without manual DNS updates.