--- title: "Configuring DMARC for validating the FROM: address domain for senders in Microsoft 365 | DMARC Report" description: "Configuring DMARC for validating the FROM: address domain for senders in Microsoft 365" image: "https://dmarcreport.com/og/blog/configuring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365.png" canonical: "https://dmarcreport.com/blog/configuring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365/" --- Quick Answer DMARC validates emails sent from your Microsoft 365 domain to prevent spoofed senders from attempting business email compromise (BEC) attacks, ransomware, and other phishing instances. For the DMARC validation process, the domains in the MAIL FROM and FROM addresses are verified for alignment. Related: [Free DMARC Checker](/tools/dmarc-checker/) ·[How to Create an SPF Record](/tools/spf-record-generator/) ·[SPF Record Format](/blog/spf-format-checker-dos-and-donts-for-email-authentication/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fconfiguring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Configuring%20DMARC%20for%20validating%20the%20FROM%3A%20address%20domain%20for%20senders%20in%20Microsoft%20365&url=undefined%2Fblog%2Fconfiguring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fconfiguring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fconfiguring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365%2F&title=Configuring%20DMARC%20for%20validating%20the%20FROM%3A%20address%20domain%20for%20senders%20in%20Microsoft%20365 "Share on Reddit") [ ](mailto:?subject=Configuring%20DMARC%20for%20validating%20the%20FROM%3A%20address%20domain%20for%20senders%20in%20Microsoft%20365&body=Check out this article: undefined%2Fblog%2Fconfiguring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365%2F "Share via Email") ![Microsoft 365](https://media.mailhop.org/dmarcreport/images/2024/06/dmarc-analyzer-9.jpg) ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) ![configuring dmarc](https://media.mailhop.org/dmarcreport/images/2024/06/dmarc-check-3-150x150.jpg) DMARC validates emails sent from your Microsoft 365 domain to prevent spoofed senders from attempting [business email compromise (BEC) attacks](https://www.bleepingcomputer.com/news/security/hackers-impersonate-us-government-agencies-in-bec-attacks/), ransomware, and other phishing instances. For the **DMARC validation process**, the domains in the MAIL FROM and FROM addresses are verified for alignment. ## DMARC in Microsoft 365 for different domain types ### For MOERA domain users [SPF](/dmarc-fundamentals/what-is-spf/) and DKIM are already configured for Microsoft Online Email Routing Address or MOERA domain (for example, testing.onmicrosoft.com), but you have to generate and publish a DMARC record for it in the **Microsoft 365 admin center**. See our walkthrough on [how to create a DMARC record](/create-dmarc-record/) if you’re doing this for the first time. ### For custom domain users You need to set up SPF and DKIM for all the **domains and subdomains** you own, including the parked ones. Once done, you need to configure [DMARC](/what-is-dmarc/) for them, as described later in this article. Here are a few considerations you need to bear in mind- ### Subdomains _For email services you don’t control directly, it’s better to use a subdomain so that you don’t have to deal with related issues_. This will also protect your [brand reputation](https://www.agilitypr.com/pr-news/public-relations/brand-reputation-in-focus-why-it-matters-what-factors-impact-it-how-to-measure-it-and-how-it-drives-success/#:~:text=It%20can%20be%20defined%20as,the%20behavior%20of%20the%20employees.). Unlike SPF and DKIM, a DMARC TXT record **automatically covers all subdomains** that don’t have their own DMARC records. You can create a specific DMARC record for a subdomain to override this inheritance. However, each subdomain still needs its own SPF and [DKIM](/blog/dkim-explained-how-dkim-works-and-why-is-dkim-important-for-organizations/) records for DMARC to function correctly. ### If your domain is not registered For unused or parked domains, set the **DMARC TXT records** to indicate that no email should come from them. This applies to the \*.onmicrosoft.com domain if not used for email. ### For online email service users If you use an email service that modifies messages before **delivery to Microsoft 365**, mark the service as a trusted ARC sealer to prevent the modified messages from failing DMARC checks. ![dns records](https://media.mailhop.org/dmarcreport/images/2024/06/dmarc-office-365-4968.jpg) ## Adding DMARC records for .onmicrosoft.com domains in Microsoft 365 1. Go to the Microsoft 365 admin center. 2. Select **Show All > Settings > Domains**, or go directly to the Domains page using [this link](https://admin.microsoft.com/Adminportal/Home#/Domains). 3. _On the Domains page, select the \*.onmicrosoft.com domain by clicking anywhere in the row except the checkbox_. 4. In the domain details page, go to the **DNS records** tab. 5. Click **Add record** on the [DNS records](https://gcore.com/learning/dns-records-explained/) tab. 6. In the **Add a custom DNS record** flyout, configure the following settings: - **Type**: Verify that **TXT (Text)** is selected - **TXT Name**: Enter \_**dmarc** - **TXT Value**: Enter **v=DMARC1; p=reject** - **TTL**: Verify that **1 hour** or **3600 seconds** is selected. 1. When you’re finished on the **Add a custom DNS record** flyout, select **Save**. ## Configuring DMARC for active custom domains in Microsoft 365 It’s best for your **domain health and reputation** if you gradually proceed toward the best protection against spoofing and phishing. Don’t set your [DMARC record](/dmarc-record/) to p=reject right from the start; begin with p=none and monitor the results for testing and verifying to prevent recipients’ mailboxes from rejecting genuine emails because of unintentional DMARC failures. Run a [DMARC record lookup](/tools/dmarc-checker/) to confirm the policy is published correctly before you start monitoring. Run a [DMARC checker](/tools/dmarc-checker/) after publishing to confirm the record is valid. We suggest you also opt to receive aggregate and forensic reports to get the **number and sources of emails** that pass and fail DMARC checks. _These reports give you insights into your email traffic, further helping you troubleshoot issues_. Once you gain confidence and the number of [false positives](https://www.forbes.com/sites/shashankagarwal/2024/06/12/battling-ai-hallucinations--detect-and-defeat-false-positives/) goes down, move to p=quarantine and continue monitoring the aggregate and forensic reports. We suggest using the ‘**pct=’ tag**, also called the percentage tag. The \`pct\` tag in a DMARC record specifies the percentage of email messages to which the [DMARC policy](/blog/what-is-a-dmarc-policy-and-how-does-it-affect-sending-my-emails/) is applied. For example, \`pct=50\` means the policy is applied to 50% of emails. You can move in the following increment to test the policy’s impact on a portion of [email traffic](https://emailanalytics.com/email-traffic/) before applying it to all messages. - pct=10 - pct=25 - pct=50 - pct=75 - pct=100 The end goal is to set the DMARC policy to **p=reject** and continue reviewing the reports. You can also use the ‘pct=’ tag here. ## DMARC for inbound emails in Microsoft 365 DMARC authentication checks for emails coming in Microsoft 365 are affected by the following features in [Exchange Online Protection or EOP](https://spanning.com/blog/exchange-online-protection-eop/): ![Exchange Online Protection](https://media.mailhop.org/dmarcreport/images/2024/06/create-dmarc-record-1.jpg) - Whether [spoof intelligence](https://www.linkedin.com/pulse/spoof-intelligence-added-all-exchange-online-plans-michael-sampson) is turned on or off in the anti-phishing policy. _Turning it off removes implicit spoofing protection from composite authentication checks_. - Whether the “Honor DMARC record policy when the message is detected as spoof” setting is turned on or off in the **anti-phishing policy**. Actions are based on the DMARC policy of the source domain (p=quarantine or p=reject in the DMARC TXT record). Also, note that Microsoft 365 doesn’t send [DMARC forensic reports](/dmarc-forensic-report/) even if you add a valid ‘ruf=mailto:’ address to your DMARC record. On the bright side, it sends [DMARC aggregate reports](/dmarc-aggregate-reports/) to all domains with a valid ‘rua=mailto:’ address in their DMARC records. However, this requires the [MX record](https://en.wikipedia.org/wiki/MX%5Frecord) to point directly to Microsoft 365\. This limitation applies to hybrid or standalone EOP scenarios where mail is first delivered to the **on-premises environment** and then routed to Microsoft 365 using a connector. We at [DMARCReport](/) help with everything related to receiving and **monitoring DMARC** aggregate and forensic reports. So, if you feel stuck or confused at any point, [contact us](/contact/); we’ll handle the reports on your behalf. You can also learn [how to do a DMARC lookup](/blog/how-to-perform-dmarc-lookup-check-domain-email-authentication-status/) to check any domain’s status yourself. ## Topics [ dkim ](/tags/dkim/)[ DMARC ](/tags/dmarc/)[ dmarc record ](/tags/dmarc-record/)[ dmarc record policy ](/tags/dmarc-record-policy/)[ dns record ](/tags/dns-record/)[ SPF ](/tags/spf/) ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fconfiguring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365%2F) [ ](https://twitter.com/intent/tweet?text=Configuring%20DMARC%20for%20validating%20the%20FROM%3A%20address%20domain%20for%20senders%20in%20Microsoft%20365&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fconfiguring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fconfiguring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365%2F) Copy Related Articles - [ ![Email Security](https://media.mailhop.org/dmarcreport/images/2025/10/dmarc-check-5211.jpg) Best DMARC Tools for 2025 Uncategorized ](/blog/best-dmarc-tools-for-2025/) - [ ![DMARC policy](https://media.mailhop.org/dmarcreport/images/2026/03/create-dmarc-record-7764.jpg) What are the best practices for setting a strict DMARC policy when sending to Gmail addresses? Uncategorized ](/blog/best-practices-setting-strict-dmarc-policy-sending-gmail-addresses/) - [ ![dmarc](https://media.mailhop.org/dmarcreport/images/2026/03/dmarc-check-5091.jpg) Complete Guide to Setting Up a DMARC Policy for Gmail Domains Uncategorized ](/blog/complete-guide-to-setting-dmarc-policy-for-gmail-domains/) - [ ![Msps And Service Providers](https://media.mailhop.org/dmarcreport/images/2025/08/what-is-dmarc-6654.jpg) Comprehensive Guide To DMARC Monitoring Services For Msps And Service Providers Uncategorized ](/blog/comprehensive-guide-to-dmarc-monitoring-for-msps-and-service-providers/) ## Related Articles [ Uncategorized 8m Best DMARC Tools for 2025 Oct 9, 2025 ](/blog/best-dmarc-tools-for-2025/)[ Uncategorized 13m What are the best practices for setting a strict DMARC policy when sending to Gmail addresses? Mar 12, 2026 ](/blog/best-practices-setting-strict-dmarc-policy-sending-gmail-addresses/)[ Uncategorized 11m Complete Guide to Setting Up a DMARC Policy for Gmail Domains Mar 16, 2026 ](/blog/complete-guide-to-setting-dmarc-policy-for-gmail-domains/)[ Uncategorized 12m Comprehensive Guide To DMARC Monitoring Services For Msps And Service Providers Aug 26, 2025 ](/blog/comprehensive-guide-to-dmarc-monitoring-for-msps-and-service-providers/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Configuring DMARC for validating the FROM: address domain for senders in Microsoft 365","description":"Configuring DMARC for validating the FROM: address domain for senders in Microsoft 365","url":"https://dmarcreport.com/blog/configuring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365/","datePublished":"2024-06-27T15:13:21.000Z","dateModified":"2025-06-05T19:45:58.000Z","dateCreated":"2024-06-27T15:13:21.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/configuring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365/"},"articleSection":"uncategorized","keywords":"dkim, DMARC, dmarc record, dmarc record policy, dns record, SPF","wordCount":884,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/images/2024/06/dmarc-analyzer-9.jpg","caption":"Microsoft 365","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Uncategorized","item":"https://dmarcreport.com/uncategorized/"},{"@type":"ListItem","position":4,"name":"Configuring DMARC for validating the FROM: address domain for senders in Microsoft 365","item":"https://dmarcreport.com/blog/configuring-dmarc-for-validating-the-from-address-domain-senders-in-microsoft-365/"}]} ```