Microsoft 365 How-To Guides

Step-by-step guides for Microsoft 365 admins: set up SPF, enable DKIM and roll out DMARC for your custom domains, with links to free browser tools to build and check each record.

Home › Guides

Email authentication for Microsoft 365

Work through them in this order. SPF and DKIM are prerequisites for DMARC.

SPF for Microsoft 365: Publish one SPF record with include:spf.protection.outlook.com, add third-party senders and stay under 10 DNS lookups.
DKIM for Microsoft 365: Create the selector1/selector2 CNAMEs, turn on signing in the Defender portal or PowerShell, and rotate to 2048-bit keys.
DMARC for Microsoft 365: Roll out DMARC from p=none to quarantine to reject with reporting, subdomain policy and Microsoft 365 inbound handling.

Tools used in these guides

SPF Record Builder and SPF Record Checker
DKIM Record Explainer
DMARC Record Generator and DMARC Record Checker
Email Deliverability Checker (SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI in one pass)
Email Header Analyzer (Authentication-Results, compauth, SCL)
DNS Lookup, DNS Propagation Checker and M365 Tenant Lookup
MTA-STS Policy Generator and TLS-RPT Record Generator

Audit hundreds of domains at once

Need SPF, DMARC and MX checks across a whole client list? Run the Bulk SPF / DMARC / MX Auditor on Apify ($2 per 1,000 domains).

Want the full kit?

Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.