How to Set Up SPF for Microsoft 365

Quick answer

If Microsoft 365 is the only service that sends mail as your domain, publish this single TXT record at the root of the domain (host @):

v=spf1 include:spf.protection.outlook.com -all

Using GCC High or DoD? The include is spf.protection.office365.us. Microsoft 365 operated by 21Vianet uses spf.protection.partner.outlook.cn. Commercial and GCC tenants use spf.protection.outlook.com.

Your *.onmicrosoft.com domain already has SPF; Microsoft owns that zone, so you can't (and don't need to) change it. Everything below is for custom domains such as contoso.com.

What SPF actually checks

SPF lists the servers allowed to send mail for a domain. The receiver checks the envelope sender (MAIL FROM / Return-Path, also called the 5321.MailFrom), not the From address people see. That matters for DMARC: SPF only helps DMARC pass when the MAIL FROM domain aligns with the visible From domain. SPF also breaks when mail is forwarded, which is why you need DKIM as well.

Step 1: Check what is published today

1. Run your domain through the SPF Record Checker. It shows the live record, expands every include and counts DNS lookups.
2. Or query the TXT records with the DNS Lookup tool, or from PowerShell: Resolve-DnsName contoso.com -Type TXT.
3. Look for more than one record starting with v=spf1. Two SPF records is a permanent error (permerror) and SPF fails for all your mail. Merge them into one.

Step 2: List every service that sends as your domain

Check DMARC aggregate reports if you have them (see the DMARC guide), then ask around. Typical senders:

• Microsoft 365 / Exchange Online: include:spf.protection.outlook.com.
• On-premises Exchange (hybrid), scanners, printers, line-of-business apps that send straight to the internet from your own public IPs: ip4:203.0.113.10 or ip4:203.0.113.0/28. Devices that relay through Exchange Online are already covered by the Microsoft include.
• Third-party services (marketing, CRM, ticketing, invoicing, HR). Each publishes its own include; common examples are include:_spf.google.com (Google Workspace), include:sendgrid.net (SendGrid), include:mailgun.org (Mailgun) and include:_spf.salesforce.com (Salesforce). Always copy the exact value from the vendor's current documentation.

Many bulk-mail services send with their own bounce domain in MAIL FROM, so adding their include to your root record does nothing for DMARC alignment. For those, set up DKIM signing with your domain at the vendor (and a custom return-path/bounce domain if they offer one), or move them to a subdomain such as marketing.contoso.com with its own SPF record. Microsoft recommends subdomains for services you don't directly control.

Step 3: Build one record

Combine everything into a single record with the SPF Record Builder. Example for Microsoft 365 plus one on-premises relay and SendGrid:

v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com include:sendgrid.net -all

• Start with v=spf1, end with one all term. Anything after all is ignored.
• You don't need a or mx for Microsoft 365. Your MX points at Exchange Online Protection for inbound mail; those terms only cost lookups.
• Never use +all (lets the whole internet pass) or ptr (deprecated, slow).
• Don't use the old SPF DNS record type (type 99). Publish SPF as a TXT record only.

Step 4: Stay under 10 DNS lookups

RFC 7208 caps SPF evaluation at 10 DNS lookups. include, a, mx, ptr, exists and redirect each cost one, and nested includes inside a vendor's record count too. ip4, ip6 and all are free. Go over 10 and receivers return permerror, which DMARC treats as an SPF fail. RFC 7208 also allows only 2 "void" lookups (names that return nothing).

When we checked in October 2026, spf.protection.outlook.com listed Microsoft's IP ranges directly, so it cost one lookup. Microsoft can change that, so recount with the SPF Checker after every edit. To get back under the limit:

1. Remove senders you no longer use (old marketing tools are the usual culprits).
2. Move third-party senders to subdomains. Each subdomain gets its own 10-lookup budget.
3. Replace a vendor include with its ip4/ip6 ranges ("flattening") only if the vendor publishes stable ranges, and recheck them regularly. Microsoft says not to flatten spf.protection.outlook.com because its IP addresses change.

Step 5: Choose -all or ~all

• -all (hard fail): anything not listed is unauthorized. Microsoft recommends -all for Microsoft 365 domains, alongside DKIM and DMARC, so DMARC can act on mail that fails SPF and has no DKIM signature.
• ~all (soft fail): unlisted senders are probably unauthorized. Reasonable while you are still finding senders.
• ?all (neutral): for testing only. Don't leave it in production.

DMARC treats both -all and ~all results as SPF failures. Your DMARC policy, not the SPF qualifier, is what really decides whether spoofed mail is junked or rejected. A practical order: ~all while you build the inventory, then -all once DMARC reports show every legitimate source passing.

Step 6: Publish and verify

1. At your DNS host, create or edit the TXT record on the root (@). Microsoft recommends a TTL of at least 3600 seconds (1 hour).
2. Records longer than 255 characters must be split into several quoted strings in the same TXT record. Most DNS hosts do this for you.
3. Confirm the new value is visible worldwide with the DNS Propagation Checker (TXT type), then rerun the SPF Checker.
4. Send a test message to an outside mailbox and paste its headers into the Email Header Analyzer. Look for spf=pass and an smtp.mailfrom domain that matches your From domain.

Subdomains and parked domains

• SPF is not inherited. Every subdomain that sends mail (for example marketing.contoso.com) needs its own SPF record. DMARC, on the other hand, does cover subdomains.
• For domains you own but never send from, publish v=spf1 -all plus a DMARC record of v=DMARC1; p=reject;. Don't publish DKIM records for them.

Common SPF mistakes in Microsoft 365 tenants

• Two SPF records after adding a new service (merge them).
• Typos Microsoft calls out: include=spf.protection.outlook.com (equals sign), include: spf.protection.outlook.com (space), or a trailing dot after the domain name.
• Copying another tenant's or cloud's include (GCC High tenants need spf.protection.office365.us).
• Adding Microsoft's IP ranges by hand as well as the include.
• Expecting SPF on the root domain to cover mail sent from a subdomain.
• Treating SPF as enough. Without DKIM and DMARC, anyone can still spoof your visible From address.

Audit hundreds of domains at once

Need SPF, DMARC and MX checks across a whole client list? Run the Bulk SPF / DMARC / MX Auditor on Apify ($2 per 1,000 domains).

Related tools and guides

Build or test records with the SPF Record Builder and SPF Record Checker, check the whole domain with the Email Deliverability Checker, and confirm which tenant owns a domain with the M365 Tenant Lookup. Next steps: enable DKIM, then set up DMARC.

FAQ

What is the correct SPF record for Microsoft 365?

For commercial and GCC tenants where Microsoft 365 is the only sender: v=spf1 include:spf.protection.outlook.com -all as a TXT record at the domain root. GCC High and DoD use include:spf.protection.office365.us, and 21Vianet uses include:spf.protection.partner.outlook.cn.

Can I have two SPF records?

No. If a domain publishes more than one TXT record starting with v=spf1, receivers return a permanent error and SPF fails for all mail. Put every sender into one record.

Should I use -all or ~all with Microsoft 365?

Microsoft recommends -all (hard fail) for Microsoft 365 domains once DKIM and DMARC are in place. Use ~all only while you are still discovering legitimate senders, then switch.

How many DNS lookups does include:spf.protection.outlook.com use?

When we checked in October 2026 it listed IP ranges directly, so it cost one lookup out of the 10 allowed. Microsoft can change its record, so count your whole record with an SPF checker after every change.

Do I need an SPF record for my onmicrosoft.com domain?

No. Microsoft owns onmicrosoft.com and already publishes SPF for it, and you can not modify that record. You do need a DMARC record for it, which you add in the Microsoft 365 admin center.

Want the full kit?

Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.