ES Email Solutions
Technical Guide

Microsoft 365 Email Authentication (SPF, DKIM, DMARC)

Written by Email Solutions Last reviewed July 13, 2026

Check your domain free on /report

Last reviewed: July 13, 2026 · Written by Email Solutions

This guide covers two related but different problems:

  1. Business DNS setup — making Microsoft 365 mail authenticate so Gmail and others trust it
  2. Outlook.com bulk sender rules — domains sending 5,000+ messages/day to consumer Outlook/Hotmail/Live addresses

Scan your domain anytime on the free report.

Sources:

Part A — Authenticate your Microsoft 365 domain

SPF

Publish one SPF TXT at the apex (or the sending subdomain). Microsoft's include for Exchange Online is commonly:

v=spf1 include:spf.protection.outlook.com -all

If Google Workspace or an ESP also sends as the same From domain, merge includes into a single record. Multiple v=spf1 TXT rows cause failures — see SPF PermError.

dig +short TXT example.com
dig +short MX example.com

MX for Microsoft 365 typically looks like example-com.mail.protection.outlook.com. If MX still points at an old host, fix routing before chasing spam complaints.

DKIM

  1. Sign in to Microsoft 365 Defender / the DKIM page in Exchange Online for your domain
  2. Microsoft asks for two CNAME records (selectors such as selector1 / selector2 pointing at Microsoft-hosted targets)
  3. Publish those CNAMEs at your DNS host (GoDaddy, Namecheap, Cloudflare, etc.)
  4. Enable DKIM signing for the domain in the admin UI after DNS propagates
dig +short CNAME selector1._domainkey.example.com
dig +short CNAME selector2._domainkey.example.com

Exact hostnames are shown in Microsoft's UI for your tenant — copy them; do not invent selector names from a blog.

DMARC

Start with monitoring:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Host: _dmarc

dig +short TXT _dmarc.example.com

DMARC passes when SPF or DKIM aligns with the visible From domain. Third-party tools that send as billing@yourdomain.com need their own SPF authorization and/or DKIM alignment — otherwise reports will show failures even when M365 itself is clean.

Part B — Outlook.com high-volume senders (5,000+/day)

Effective May 5, 2025, Microsoft's postmaster policies require domains sending more than 5,000 emails per day to Outlook.com consumer accounts (@outlook.com, @hotmail.com, @live.com) to be compliant with SPF, DKIM, and DMARC.

Non-compliant high-volume mail may be junked or rejected with:

550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.

Microsoft documents p=none as the minimum DMARC policy, with stronger policies recommended.

This bulk consumer rule is not identical to "my coworker on Exchange Online says mail is in junk." Always separate:

Symptom First checks
Internal M365 → M365 junk Transport rules, user junk settings, Safe Links
External Gmail junk SPF/DKIM/DMARC to Gmail + content/reputation
High volume → Outlook.com 5.7.515 Bulk auth compliance per postmaster policies

Practical verification order

  1. MX points at *.mail.protection.outlook.com
  2. Single SPF includes spf.protection.outlook.com
  3. DKIM enabled with both CNAMEs resolving
  4. _dmarc published
  5. /report + a real test send to a personal Gmail and Outlook.com address
  6. If you send marketing volume, also read the bulk sender checklist

Ready to Land in the Inbox?

Don't want to edit your DNS manually? Hit our 1-Click Fix or Book an Emergency Setup Call.

Don't want to edit your DNS manually? Hit our 1-Click Fix or Book an Emergency Setup Call.

Report 1-Click Fix $150