How to set up DMARC in Microsoft 365

Do the three records in this order. One SPF TXT record. DKIM, using the CNAME pair the Defender portal shows for this tenant. Then a DMARC TXT record at p=none. The pages below were read on 2026-10-15. If a portal label has moved, the record names on those Learn articles are the part that matters.

The order, without the Microsoft-specific clicks, is How to set up DMARC. Google Workspace is a different console, covered in the Workspace note.

1. One SPF record, with Microsoft's include

SPF is a TXT record on the domain itself. Microsoft's SPF article says most Microsoft 365 organizations need include:spf.protection.outlook.com in that record. Their example, for a domain that also lists two on-premises addresses, is v=spf1 ip4:192.168.0.10 ip4:192.168.0.12 include:spf.protection.outlook.com -all. If you have no on-premises server, you do not invent those ip4 values. A mailbox-only domain is the include plus an enforcement tag.

One record. A second TXT record that also starts with v=spf1 is a permanent error under RFC 7208. A newsletter, a helpdesk, or a scanner gets its include added to this same record. Microsoft's page says -all means hosts you did not list are not authorized. Use ~all only while you are still finding senders, then change it.

include and the other lookup mechanisms are capped at 10 DNS lookups, and lookups inside an include count (RFC 7208 section 4.6.4). Drop includes for products you cancelled.

2. Copy the two DKIM CNAMEs, then enable signing

Microsoft's DKIM article says a custom domain does not get DKIM signing until you configure it. Mail from you@contoso.onmicrosoft.com is signed as that onmicrosoft.com domain. Mail from you@company.com is not signed as company.com until these records exist. DMARC alignment needs the signature d= domain to match the From domain. A signature on the onmicrosoft.com name does not do that job.

The DNS names are always selector1._domainkey and selector2._domainkey. The targets are not something you reconstruct. Microsoft says the examples in the article are illustrations. Domains that picked up the format they introduced in May 2025 point at a name like selector1-company-com._domainkey.yourtenant.n-v1.dkim.mail.microsoft. The letter before -v1 is assigned by Microsoft. Older domains still use selector1-company-com._domainkey.yourtenant.onmicrosoft.com. Both formats are real. Only the pair for this domain is the one you publish.

In the Defender portal, open Email & collaboration, Policies & rules, Threat policies, Email authentication settings, then the DKIM tab. The direct page they document is https://security.microsoft.com/authentication. For a domain whose status is No DKIM keys, their procedure is to try the enable toggle, dismiss the client error, open the domain details, and copy the Publish CNAMEs section. Create those two CNAME records at the DNS host. When Microsoft can see them, turn on "Sign messages for this domain with DKIM signatures."

If you use Exchange Online PowerShell, the command on that page is Get-DkimSigningConfig -Identity company.com | Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME. Replace the domain. Only one selector is active. The other is for a later key rotation. You still publish both CNAMEs.

The header's s= value is not always the word selector1. Microsoft's example is s=selector1-contoso-com. The DNS host you create is still selector1._domainkey. Send a new message after signing is on. Old mail is not signed after the fact.

3. Publish DMARC at the DNS host, at p=none

Microsoft's DMARC article says there is no portal or PowerShell cmdlet that manages DMARC for a custom domain. You add the TXT record where the domain's DNS is hosted. The admin-center click path on that page is for the *.onmicrosoft.com domain only.

Start here. Use a shared mailbox, not a person who might leave.

Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@company.com

p=none does not ask receivers to junk or reject anything. It asks for reports. Microsoft's rollout is explicit: stay on p=none and read the results, move to p=quarantine, then to p=reject. If you want a smaller first enforcement step, they list pct at 10, then 25, 50, 75, and 100. If you omit pct, it defaults to 100. Do not leave it at 10 and call the policy finished.

Their sample records include ruf=mailto:. The same article says Microsoft 365 does not send forensic reports, even when a valid ruf address is published. Aggregate reports go to a valid rua address when the MX points at Microsoft 365. Read those. A report address on a different domain has to authorize you (RFC 7489 section 7.1). An address on your own domain does not need that extra record.

Subdomains inherit the parent DMARC record unless they have their own. Each subdomain you actually send from still needs its own SPF and DKIM. Microsoft also says a domain you own and do not use for mail should publish v=DMARC1; p=reject; and should not get DKIM CNAMEs.

One more outbound consequence from that page: if your policy is already p=quarantine or p=reject and a destination says your mail failed DMARC, Microsoft routes that outbound mail through the high-risk delivery pool. That is a reason to fix a real sender before you tighten p=, not a reason to skip the policy.

Check the records, or hand the rollout off

/check reads MX, SPF, DMARC, and five common DKIM names, including selector1 and selector2. It stores nothing. It does not open the Defender portal and it does not read aggregate reports. A pass there means the TXT and CNAME names answered. It does not mean a message you sent yesterday was signed.

The $9 report is that same live lookup, written out with a fix for each unfinished row. It is built when a license key from the purchase is present. If the checkout link is not connected, the page says Coming soon. Nothing is stored.

If you want DME Computer Services in Omaha to publish the records and read the aggregate reports for 30 days, that is DMARC setup. $199 is one Google or Microsoft domain. $499 is three domains or extra senders. The rollout starts at monitor mode unless the reports are already clean. Questions go to info@dmeomaha.com.