Microsoft 365
Publish tenant-specific email DNS safely.
Microsoft supplies domain-specific MX and DKIM targets. Copy those exact values; generic examples cannot replace tenant-generated records.
Keep separate
- MX routes inbound mail.
- SPF authorizes envelope senders.
- Two DKIM CNAMEs delegate selectors to Microsoft.
- DMARC evaluates aligned SPF or DKIM.
Walkthrough
- Verify the domain. Publish the exact Microsoft verification record if setup requests one.
- Publish mail routing. Use the tenant-specific MX and required autodiscover/service records shown in Microsoft 365.
- Merge SPF. Include
spf.protection.outlook.comin the single SPF record with any other legitimate senders. - Publish both DKIM CNAMEs. Use selector1 and selector2 names and their exact tenant-specific targets.
- Enable DKIM. Wait until both CNAMEs resolve, then enable signing in Microsoft 365.
- Stage DMARC. Monitor, review alignment, then increase enforcement only after expected mail is clean.
Generic record shapes
SPF
@ TXT "v=spf1 include:spf.protection.outlook.com ~all"DKIM selector 1
selector1._domainkey CNAME TENANT_SPECIFIC_SELECTOR1_TARGETDKIM selector 2
selector2._domainkey CNAME TENANT_SPECIFIC_SELECTOR2_TARGETDMARC monitor
_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r;"Verification
- Microsoft reports domain setup healthy.
- Exactly one SPF record exists.
- Both DKIM CNAME chains resolve.
- DKIM signing is enabled.
- Test mail passes authentication.
- DMARC alignment matches the visible From domain.