Understanding Microsoft 365 / Office 365 (Exchange Online) Email Authentication
Microsoft 365 Exchange Online enforces dual-selector CNAME-based DKIM rotation (selector1 and selector2) and requires SPF authorization via "include:spf.protection.outlook.com".
When Microsoft 365 / Office 365 (Exchange Online) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Microsoft 365 / Office 365 (Exchange Online)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Microsoft 365
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:spf.protection.outlook.com -all | 3600 | Authorizes Exchange Online sending servers. |
| CNAME | selector1._domainkey | selector1-domain-com._domainkey.domain.onmicrosoft.com | 3600 | Primary DKIM endpoint. |
| CNAME | selector2._domainkey | selector2-domain-com._domainkey.domain.onmicrosoft.com | 3600 | Secondary DKIM endpoint. |
Step-by-Step Setup Instructions
Open DNS Zone Editor for your domain.
Add "include:spf.protection.outlook.com" to your existing root SPF TXT record.
Go to Microsoft Defender portal > Threat Policies > DKIM.
Add both CNAME records (selector1 and selector2) pointing to your ".onmicrosoft.com" endpoint.
Enable DKIM signing in Microsoft Defender.
Common Microsoft 365 SPF Configuration Mistakes
× DKIM Toggle Fails in Admin
Cause: Attempting to toggle before CNAMEs propagate.
Fix: Wait 15 minutes and retry.
Frequently Asked Questions
Why does Microsoft 365 use two DKIM selectors?
To support automatic cryptographic key rotation without manual DNS updates.
What is the SPF record for Microsoft 365 / Exchange Online?
The SPF include is "include:spf.protection.outlook.com". The complete record is "v=spf1 include:spf.protection.outlook.com -all". Microsoft uses -all (hardfail) for strict rejection of unauthorized senders.
Why does Microsoft 365 DKIM use CNAME records instead of TXT?
Microsoft uses CNAME-based DKIM (selector1._domainkey and selector2._domainkey pointing to your .onmicrosoft.com endpoint) to enable automatic background key rotation. When Microsoft rotates keys, the CNAME destination updates without requiring DNS changes on your end.
How do I enable DKIM signing in Microsoft 365?
Go to the Microsoft Defender portal > Email & Collaboration > Policies & Rules > Threat Policies > Email Authentication Settings > DKIM. Select your domain and enable the DKIM signing toggle. Both CNAME records must be published in DNS before enabling.
What DMARC policy does Microsoft recommend for 365 tenants?
Microsoft recommends v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com. Start with p=none and monitor DMARC aggregate reports for 30-90 days before enforcing p=reject to avoid blocking legitimate mail sources.
Will Microsoft 365 emails pass DMARC on a custom domain?
Yes, provided you publish include:spf.protection.outlook.com in SPF and enable DKIM signing in the Defender portal. When both pass with d=yourdomain.com alignment, your DMARC policy is satisfied.