← All articles

Setting up SPF, DKIM and DMARC for Microsoft 365 (Exchange Online): step by step

Complete email authentication for Microsoft 365: the SPF record at your DNS provider, creating DKIM in the Defender portal, publishing the CNAMEs and switching it on, setting DMARC — with the two typical Exchange Online traps.

7 min read · Updated 7 September 2026

For Microsoft 365 you set SPF and DMARC at your domain's DNS provider (there is no portal for that in Microsoft 365), but DKIM in the Microsoft Defender portal: security.microsoft.com/authentication → "DKIM" tab → domain → "Create DKIM keys" → publish the two CNAMEs shown in DNS → switch on the toggle "Sign messages for this domain with DKIM signatures". The basic SPF record is suggested during domain setup; DKIM and DMARC remain manual work — and that is exactly where the two traps we see most often in practice are hiding.

Step 1: SPF at the DNS provider

Microsoft states it explicitly: for SPF there is neither an admin portal nor a PowerShell cmdlet — the TXT record is created at the registrar or DNS hoster (e.g. World4You, Strato, IONOS). Microsoft recommends -all because DMARC handles the rest:

Step 2: Create DKIM in the Defender portal

• In the Defender portal https://security.microsoft.com go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings — or open https://security.microsoft.com/authentication directly.
• Select the "DKIM" tab and click your own domain.
• At the bottom of the details flyout click "Create DKIM keys" — Microsoft then shows the two CNAME records under "Publish CNAMEs".
• Create both CNAMEs at your DNS provider (host names selector1._domainkey and selector2._domainkey, targets copied exactly from the portal).
• After a while, return to the portal and switch on the toggle "Sign messages for this domain with DKIM signatures". Only then is DKIM active.

Step 3: DMARC at the DNS provider

Microsoft does not create DMARC for you. The TXT record under _dmarc goes to the DNS provider like SPF — first with p=none and a reporting address, read reports for a few weeks, then via quarantine to reject (step-by-step plan). Microsoft itself recommends quickly setting DKIM and DMARC in monitoring mode in complex environments, because the reports reveal the forgotten senders:

Step 4: Check

After switching on, send an email to a Gmail mailbox and open "Show original" there: spf=pass, dkim=pass with your domain, dmarc=pass is the goal. Or check the domain here — then you also see whether both selectors can be found. In the Defender portal the domain's status must be "Valid"; "CnameMissing" means a CNAME is missing or not yet propagated.