How to Set Up DMARC for Microsoft 365 (none to quarantine to reject)

Set up DMARC for Microsoft 365 step by step: SPF and DKIM prerequisites, onmicrosoft.com and custom domains, a safe p=none to quarantine to reject rollout, rua reports, sp= for subdomains, and how Microsoft 365 handles inbound DMARC.

Quick answer

Once SPF and DKIM are working for your custom domain, publish a TXT record on host _dmarc (so _dmarc.contoso.com):

v=DMARC1; p=none; rua=mailto:dmarc-reports@contoso.com

Read the aggregate reports, fix every legitimate sender that fails, then move to p=quarantine and finally p=reject. Microsoft's goal for every custom domain and subdomain is p=reject. Build the record with the DMARC Record Generator and check it with the DMARC Record Checker.

What DMARC checks

A message passes DMARC when SPF or DKIM passes and is aligned with the domain in the visible From address:

SPF alignment: the MAIL FROM (Return-Path) domain matches the From domain.
DKIM alignment: the signing domain (d=) matches the From domain.

Alignment is relaxed by default (aspf=r, adkim=r), so bounces.contoso.com aligns with contoso.com. A signature from contoso.onmicrosoft.com or a vendor's own domain does not align with contoso.com. If both checks fail, the receiver applies your policy (p=).

Step 2: onmicrosoft.com vs custom domains

*.onmicrosoft.com (initial / MOERA domain): Microsoft already handles SPF and DKIM, but you add the DMARC record, in the Microsoft 365 admin center: Settings > Domains, select the onmicrosoft.com domain, open the DNS records tab, choose Add record, type TXT, name _dmarc, value v=DMARC1; p=reject (add rua=mailto:... if you want reports). If you don't send from it, p=reject is exactly right.
Custom domains: Microsoft 365 has no portal or cmdlet for their DMARC records. Create the TXT record at your DNS host.
Parked domains (owned, never send mail): publish v=DMARC1; p=reject; straight away, along with SPF v=spf1 -all.

Step 3: Decide where reports go (rua)

Use a dedicated shared mailbox or Microsoft 365 group (for example dmarc-reports@contoso.com), not someone's personal mailbox. Reports are XML files (often gzipped), usually sent daily by each receiver.
A DMARC reporting service turns the XML into readable dashboards. Microsoft points to the DMARC vendors listed in the Microsoft Intelligent Security Association (MISA) catalog.
If the rua address is in a different domain (for example a reporting vendor's), that domain must publish an authorization record, e.g. TXT contoso.com._report._dmarc in the vendor's zone with value v=DMARC1;. Reputable vendors already do this.
Skip ruf (failure/forensic reports) at first. Few receivers send them, and Microsoft 365 never does.

Step 4: Publish p=none and monitor

Host:  _dmarc
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@contoso.com

Publish exactly one TXT record at _dmarc. Two DMARC records means receivers ignore DMARC for the domain.
Confirm it with the DMARC Record Checker and the DNS Propagation Checker (TXT, name _dmarc.contoso.com).
Watch the reports for at least a few weeks, including month-end runs (invoices, payroll, newsletters). For every source IP, work out who it is. Fix legitimate senders (SPF include and/or DKIM with your domain, or move them to a subdomain). Ignore spoofers: that's the traffic DMARC will block.

p=none already counts as a DMARC record for Outlook.com's high-volume sender rules (in force since May 5, 2025: domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses must pass SPF and DKIM and have DMARC of at least p=none, aligned with SPF or DKIM). It doesn't protect you from spoofing, though.

Step 5: Move to quarantine, gradually

Microsoft's documented rollout raises the percentage of failing mail that gets the policy:

v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc-reports@contoso.com
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@contoso.com
v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc-reports@contoso.com
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@contoso.com

Leaving out pct means 100%. Start with low-volume subdomains and save the busy parent domain for last.

Note on the new DMARC standard: RFC 9989 (May 2026, replacing RFC 7489) removes pct and adds a test-mode tag, t=y, which asks receivers to apply one level less (reject is treated as quarantine, quarantine as none). Receivers are moving to it at different speeds, and a receiver that follows RFC 9989 ignores pct, so it can apply your policy to 100% of failing mail even while you publish pct=25. Only raise the policy once reports show legitimate mail passing. If you want an explicit test step that both older and newer receivers understand, publish pct=0; t=y together, which means one level less under both standards.

Step 7: Subdomains (sp=)

Unlike SPF and DKIM, the parent DMARC record covers every subdomain (even ones that don't exist) unless the subdomain publishes its own _dmarc record.
sp= sets a different policy for subdomains. For example, v=DMARC1; p=reject; sp=quarantine; rua=... rejects for contoso.com but only quarantines subdomains while a marketing subdomain is being fixed.
A sending subdomain can have its own record, e.g. _dmarc.marketing.contoso.com with p=none while you onboard a vendor. Remember it also needs its own SPF and DKIM.
RFC 9989 adds np=, a policy for subdomains that don't exist in DNS. np=reject is a good choice once you're enforcing; receivers that don't support it yet fall back to sp or p.

How Microsoft 365 handles inbound DMARC

Anti-phishing policies in the Defender portal (Email & collaboration > Policies & rules > Threat policies > Anti-phishing) include Honor DMARC record policy when the message is detected as spoof, with separate actions for senders that publish p=quarantine and p=reject. Microsoft recommends keeping it on. Check yours with Get-AntiPhishPolicy | Format-List Name,HonorDmarcPolicy,DmarcQuarantineAction,DmarcRejectAction.
With that setting on, failing mail from a p=quarantine domain goes to Junk Email (or quarantine, if configured), and mail from a p=reject domain is rejected during SMTP.
Headers show the result in Authentication-Results: dmarc=pass, dmarc=fail action=quarantine, action=oreject (sender's policy was reject), action=pct.quarantine/pct.reject (pct sampling), or dmarc=bestguesspass (no DMARC record; Microsoft inferred a pass).
compauth (composite authentication) is Microsoft's own verdict, combining SPF, DKIM, DMARC, ARC and spoof intelligence. A message can fail compauth even when the sender has no DMARC record. compauth=fail reason=100 means the sender's DMARC policy caused it; reason=000 is an explicit authentication failure. Paste headers into the Email Header Analyzer to see all of this decoded.
Microsoft 365 sends DMARC aggregate reports to other domains only when your MX points directly at Microsoft 365, and it never sends forensic (ruf) reports. If a third-party gateway sits in front, turn on Enhanced Filtering for Connectors so SPF, DKIM and DMARC are evaluated against the real source IP.
If a trusted intermediary (mailing list, signature service, forwarding gateway) breaks DMARC for legitimate inbound mail, add it as a trusted ARC sealer rather than turning off DMARC enforcement.
Outbound: mail from your Microsoft 365 domains that fails DMARC at the recipient, when your policy is quarantine or reject, is routed through Microsoft's high-risk delivery pool. That's one more reason to fix alignment before enforcing.

Common DMARC mistakes

Publishing the record at the root (@) instead of _dmarc, or publishing two _dmarc records.
rua=dmarc@contoso.com without the mailto: prefix, or an external rua address without the authorization record.
Jumping to p=reject before DKIM is on for every custom domain, which leaves DMARC depending on SPF alone and breaks forwarded mail.
Setting strict alignment (aspf=s / adkim=s) without a reason. Relaxed is fine for nearly everyone.
Forgetting the onmicrosoft.com domain and parked domains, which are easy targets for spoofing.
Smart quotes or line breaks pasted from a document into the DNS value.
Assuming p=none protects anything. It only gives you reports.

FAQ

What DMARC record should I use for Microsoft 365?

Start with v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain as a TXT record on host _dmarc, after SPF and DKIM are working. Move to p=quarantine and then p=reject once aggregate reports show all legitimate mail passing.

Do I need DMARC for my onmicrosoft.com domain?

Yes. Microsoft handles SPF and DKIM for it, but you add the DMARC TXT record yourself in the Microsoft 365 admin center under Settings, Domains, the onmicrosoft.com domain, DNS records, Add record (name _dmarc, value v=DMARC1; p=reject).

How long should I stay at p=none?

Long enough to see every legitimate sender in your aggregate reports, usually at least a few weeks including month-end and any newsletters or billing runs. Move on when the only failing sources are ones you do not recognise.

Is pct still supported in DMARC?

RFC 9989 (May 2026) removed pct and added t=y for test mode. Many receivers still honour pct, and Microsoft documentation still shows it, but newer receivers may ignore it and apply your full policy. Only raise the policy when your reports are clean.

Why does Microsoft 365 show compauth=fail when the sender has no DMARC record?

Composite authentication is Microsoft's own verdict. It combines SPF, DKIM, DMARC, ARC and spoof intelligence, so a message can fail compauth (for example with reason 000) even without a DMARC policy. reason=100 means the sender's DMARC policy caused the failure.

How to Set Up DMARC for Microsoft 365