For Microsoft 365: publish SPF v=spf1 include:spf.protection.outlook.com -all, enable DKIM in the Defender portal (selectors selector1 and selector2, published as CNAMEs), then add a DMARC record at _dmarc beginning at p=none and progressing to p=reject.
Microsoft’s include is spf.protection.outlook.com. A clean record is v=spf1 include:spf.protection.outlook.com -all. Add other senders to the same record if needed.
In the Microsoft Defender portal (Email & collaboration → Policies → Email authentication settings → DKIM), enable DKIM for your domain. Microsoft uses two rotating selectors, selector1 and selector2, published as CNAME records pointing to …_domainkey.<tenant>.onmicrosoft.com.
Publish v=DMARC1; p=none; rua=mailto:[email protected] at _dmarc, monitor, then enforce.
It is a CNAME, so follow it:
$ dig CNAME selector1._domainkey.yourdomain.com +shortCheck your DMARC record now
Open the free DMARC checker →So Microsoft can rotate the underlying keys without you editing DNS. You publish two CNAMEs (selector1/selector2) that point to Microsoft-managed records.
Microsoft’s own guidance uses -all (hardfail) once you’re confident all senders are listed; start at ~all if you are still consolidating.
