'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Configure SPF, DKIM, and DMARC for a Microsoft Email Domain
Question details
Gmail is rejecting messages sent from a custom Microsoft email domain due to missing or incomplete email authentication records.
- Product
- Microsoft 365 / Outlook.com
- Device & OS
- not provided
- Scenario
- A user is attempting to send emails to Gmail users from a custom domain hosted on Microsoft email services, but the messages are blocked by Gmail's strict security policies.
- Observed behavior
- Outgoing emails fail to deliver to Gmail addresses, returning an error message stating that email authentication (SPF/DKIM/DMARC) is missing or incomplete.
Before modifying your DNS settings, you must identify whether your custom domain is connected to a Microsoft 365 business tenant or a consumer Outlook.com/Live.com account, as the required DNS records differ completely.
Configure Email Authentication for Microsoft 365 Business Domains
Deploy the correct SPF, DKIM, and DMARC records specifically generated for a Microsoft 365 enterprise or business tenant.
Microsoft 365 business accounts require a specific SPF include mechanism and uniquely generated DKIM signatures from the Microsoft 365 Defender portal. Do not use the consumer 'include:outlook.com' record for a Microsoft 365 tenant.
Log in to your domain registrar's DNS management portal (such as Network Solutions or GoDaddy). Add a new TXT record for the root domain (@) with the value: v=spf1 include:spf.protection.outlook.com -all
Sign in to the Microsoft 365 Defender portal. Navigate to 'Policies & Rules' > 'Threat policies' > 'DKIM'. Select your domain, click 'Create DKIM keys', and copy the two provided CNAME records into your domain's DNS manager.
Once SPF and DKIM are active, add a DMARC TXT record for the hostname '_dmarc'. Start with a monitoring policy by entering the value: v=DMARC1; p=none;
Configure SPF for Legacy Consumer Outlook.com Domains
Set up a basic SPF record for users maintaining a legacy custom domain attached to a personal Outlook.com or Live.com account.
Enhance Your Business Productivity with WPS Office
While you troubleshoot your Microsoft domain's DNS settings to secure your email communications, consider equipping your devices with WPS Office. It provides a lightweight, highly compatible, and free alternative to Microsoft Office for all your document needs.
- 1. Download and Install: Visit the WPS Office website to download the free suite and install it on your PC or Mac in minutes.
- 2. Create Your Documents: Open WPS Office to instantly start drafting Word documents, analyzing Excel spreadsheets, or designing PowerPoint slides.
- 3. Attach to Emails: Save your files in standard formats and attach them securely to emails sent from your newly configured Microsoft domain.
Frequently Asked Questions
Why is Gmail suddenly rejecting emails from my Microsoft domain?
Google and Yahoo recently updated their security policies, requiring all incoming emails to pass strict authentication checks. If your custom domain lacks properly configured SPF, DKIM, or DMARC records, Gmail will automatically reject your messages to prevent spoofing.
Can I use 'include:outlook.com' for my Microsoft 365 business domain?
No. The 'include:outlook.com' value is intended for legacy consumer accounts. If you pay for Microsoft 365 business or enterprise services, you must use 'include:spf.protection.outlook.com' in your SPF record.
What happens if I publish an SPF record without DKIM or DMARC?
While having just an SPF record is better than nothing, Gmail's bulk sender guidelines strongly recommend implementing both SPF and DKIM. DMARC ties them both together. Lacking DKIM and DMARC increases the likelihood that your emails will end up in the recipient's spam folder.
How do I test if my SPF, DKIM, and DMARC records are working?
You can use free online tools like MXToolbox or Google's Admin Toolbox (Check MX) to scan your domain. These tools will report any syntax errors in your DNS configurations.
