Back to Help Center
EMAIL AUTHENTICATION September 11, 2026 · 8 min read

How to Set Up DMARC for Microsoft 365 (Step-by-Step)

DMARC for Microsoft 365 requires SPF + DKIM to be passing first, then a phased rollout from p=none → p=quarantine → p=reject over 8-12 weeks.

DMARC for Microsoft 365 follows the same pattern as any DMARC deployment: monitor, ramp, enforce. Never skip straight to p=reject without a monitoring period.

Prerequisites

Step 1 — Publish the Initial DMARC Record

Add a TXT record at your DNS host:

  • Name — _dmarc
  • Type — TXT
  • Value — v=DMARC1; p=none; rua=mailto:[email protected]; fo=1

Full record: _dmarc.yourdomain.com.

Verify with the DMARC lookup tool after 5-30 minutes.

Step 2 — Collect Aggregate Reports (4-8 Weeks)

Daily XML reports arrive at your rua= mailbox. Use a parser (dmarcian, EasyDMARC, Postmark DMARC Digest, Valimail) to visualize them.

Watch for:

  • Non-Microsoft sending IPs — anything unexpected is either shadow-IT SaaS or spoofing
  • DKIM failures on legitimate senders — DKIM not enabled or misaligned
  • SPF pass but DMARC fail — alignment issue; envelope-sender domain doesn’t match From: domain

Common Microsoft 365 issues to fix during monitoring:

  • Bulk senders (Mailchimp, HubSpot, SendGrid) — configure their authenticated-domain feature so DKIM aligns with your root domain
  • Legacy scanners / relays — may need mailflow connector rules or SPF additions
  • Autoresponders / meeting-room aliases — usually align via Microsoft’s own signing

Step 3 — Step Up to p=quarantine

After 4-8 weeks of clean reports:

v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]; fo=1

Ramp pct=25 → 50 → 100 over 4-6 weeks.

Step 4 — Step Up to p=reject

After p=quarantine; pct=100 for 4+ weeks with no legitimate mail failing:

v=DMARC1; p=reject; rua=mailto:[email protected]; fo=1

Non-aligned mail is rejected at the receiver.

Step 5 — Subdomain Policy

By default, DMARC applies to your root and inherits to subdomains. Override for subdomains with sp=:

v=DMARC1; p=reject; sp=quarantine; rua=...

Useful if root domain is well-authenticated but subdomains still onboarding.

Common Miss

  • Skipping the monitoring period — legitimate mail from lightly-authenticated systems bounces
  • DKIM not enabled in Defender portal — DMARC alignment fails even when SPF passes
  • Missing _dmarc subdomain — record at dmarc.yourdomain.com (no underscore) is ignored
  • Multiple _dmarc TXT records — receivers ignore all of them
  • Publishing DMARC before SPF/DKIM are stable — you have nothing to enforce

Confirm each step with the DMARC lookup tool and the email authentication checker.

Read what DMARC is, the DMARC glossary entry, and follow up with how to read a DMARC report.

Related Guides
GETTING STARTED
DomainScan API Quickstart
DomainScan's API gives programmatic access to all 50+ tools including cryptographic hashing (MD5, SHA family, BLAKE2, RIPEMD-160) and password hashing (bcrypt, Argon2). This quickstart covers authentication, making your first call, the full endpoint reference, and code examples in JavaScript, Python, and curl.
GETTING STARTED
How to Read a DomainScan DNS Report
Your DNS report in DomainScan shows all records found for a domain, grouped by type, with status indicators. Here's how to interpret every field and what to look for.
EMAIL AUTHENTICATION
How to Check Email Authentication (SPF, DKIM, DMARC)
DomainScan's email authentication report checks your SPF, DKIM, and DMARC records in one pass, identifies misconfigurations, and explains what each finding means for your email deliverability and spoofing protection.
← All Help articles Learning hub →