Add this TXT record at your domain apex: v=spf1 include:spf.protection.outlook.com -all. That single include covers every Microsoft 365 sending IP for Exchange Online. If you send from other services too, chain includes: v=spf1 include:spf.protection.outlook.com include:sendgrid.net ~all. Note: Microsoft 365 documentation historically suggested -all (hard fail); use ~all (soft fail) while testing. Publish via your DNS host and verify with the email authentication checker. Look for SPF=Pass in the response.
All questions
How do I set up SPF for Microsoft 365?
Read the full guide
What Is an SPF Record?
SPF tells the world which servers are allowed to send email on behalf of your domain. A missing or misconfigured SPF record lets spammers forge your address — and sends your legitimate email straight to spam.