How to Set Up SPF for Microsoft 365 (Step-by-Step)

Setting up SPF for Microsoft 365 (Exchange Online) is a one-record change. Add the TXT, verify, tighten.

Prerequisites

Microsoft 365 tenant with your domain verified and set as primary for mail
Access to your DNS host
Knowledge of any existing SPF record on the domain (check with the SPF lookup tool)

Step 1 — Choose Your SPF Record

Microsoft 365 only:

v=spf1 include:spf.protection.outlook.com -all

Microsoft 365 plus other providers:

v=spf1 include:spf.protection.outlook.com include:sendgrid.net ~all

Notes:

Microsoft’s official docs prefer -all. Use ~all during initial rollout — reduces false rejects while auditing.
The include (spf.protection.outlook.com) consumes ~3 DNS lookups. Watch the 10-lookup limit if chaining multiple senders.

Step 2 — Publish the TXT Record

DNS host UI:

Name / Host — @ or root domain
Type — TXT
Value — v=spf1 include:spf.protection.outlook.com -all
TTL — Auto or 3600

If a previous SPF record exists (from your old mail provider), replace it. Only one SPF TXT per domain — publishing two causes PermError.

Provider-specific how-tos: Cloudflare, Route 53, GoDaddy, Namecheap.

Step 3 — Verify

Wait 5-30 minutes for propagation. Confirm with the SPF lookup tool. Expected output: SPF=Pass with the record listing.

Do a broader check with the email authentication checker — verifies SPF + DKIM + DMARC together.

Step 4 — Send a Test Message

From a Microsoft 365 mailbox to an external inbox. Inspect the headers of the received message:

Authentication-Results: spf=pass (sender IP is 40.107.x.x)
    smtp.mailfrom=yourdomain.com;

spf=pass confirms the record is doing its job.

Step 5 — Add DKIM

Once SPF is passing, enable DKIM for the same domain in the Microsoft 365 Defender portal → Email & Collaboration → Policies → DKIM. Publish the two CNAME records Microsoft provides. See the DKIM selector FAQ for details.

Step 6 — Add DMARC

After SPF + DKIM are both passing, publish DMARC at _dmarc.yourdomain.com. See how to set up DMARC for Microsoft 365.

Common Miss

Two SPF records → PermError → all authentication fails
Missing include for Microsoft 365 → mail sent from Exchange Online fails SPF
Publishing -all before verifying legitimate senders → legitimate mail bounces
Adding the record on a subdomain instead of the apex — SPF applies at the domain used in MAIL FROM, which is your root domain by default

Confirm your configuration with the email authentication checker.

Read what an SPF record is, check the SPF glossary entry, and follow up with how to find the DKIM selector for Microsoft 365.