Authenticate Microsoft 365 / Outlook for your domain

When Microsoft 365 / Outlook sends mail as your domain, receivers check that it is DKIM-signed or SPF-authorized for that domain. Without it, a strict DMARC policy will send that mail to spam or bounce it.

1. Set up Microsoft 365 / Outlook

In the Microsoft Defender portal, open Email authentication settings → DKIM, publish the two selector1/selector2 CNAME records it lists, then enable signing. Make sure your SPF record includes include:spf.protection.outlook.com.

2. Publish a DMARC record (if you don't have one)

Create a TXT record named _dmarc with a monitoring-only policy:

v=DMARC1; p=none; rua=mailto:<your report address>

Reports show whether Microsoft 365 / Outlook and your other services pass. Tighten the policy only when they all do.

3. Check it

Need help adding the records? See how at Cloudflare, GoDaddy, Namecheap, Amazon Route 53, Squarespace Domains, Porkbun. Add them where your domain's nameservers point.

DNS changes usually appear within an hour. Then check your domain.