DMARC for Office 365: Complete Setup Guide (2026)

**To set up DMARC for Microsoft 365 (Office 365), you need three DNS records: an SPF record with include:spf.protection.outlook.com, DKIM signing enabled via the Microsoft 365 Defender admin center, and a DMARC TXT record at _dmarc.yourdomain.com. Microsoft began enforcing DMARC for bulk senders in May 2025, following Google and Yahoo’s February 2024 mandate.

Per RFC 7489, DMARC requires SPF or DKIM to pass AND align with the From domain. Microsoft 365 supports both, but DKIM must be explicitly enabled — it’s not on by default for custom domains.

Step 1: Configure SPF for Office 365

Your SPF record must include Microsoft’s sending IPs:

yourdomain.com. IN TXT "v=spf1 include:spf.protection.outlook.com -all"

If you also send from other services (SendGrid, Mailchimp, etc.), chain the includes:

yourdomain.com. IN TXT "v=spf1 include:spf.protection.outlook.com include:sendgrid.net -all"

Check your SPF record →

Step 2: Enable DKIM for Office 365

1. Go to Microsoft 365 Defender → Email & collaboration → Policies & rules → Threat policies → **DKIM 2. Select your domain
2. Click **Enable to start DKIM signing
3. If prompted, add the CNAME records Microsoft provides to your DNS

Microsoft generates two DKIM selectors (selector1._domainkey and selector2._domainkey) that point at Microsoft’s key infrastructure.

Verify your DKIM selectors →

Step 3: Publish Your DMARC Record

Add a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Use our DMARC Record Generator to build the record with custom settings.

Step 4: Monitor Reports

Point your rua= address at DMARC Report to automatically parse and visualize the aggregate reports Microsoft and other receivers send you.

Office 365 DMARC setup trips up most IT teams on the DKIM step — it’s not enabled by default for custom domains, and the Microsoft admin console buries it three levels deep, says Brad Slavin, CEO of DuoCircle. Once SPF + DKIM + DMARC are all in place, use DMARC Report to verify everything aligns before enforcing.

Check your DMARC record → Start monitoring with DMARC Report →