'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Configure SPF, DKIM, and DMARC for Outlook.com Email
Question details
Configure SPF, DKIM, and DMARC records for a custom-domain Outlook.com email to improve authentication and delivery rates.
- Product
- Outlook.com
- Device & OS
- not provided
- Scenario
- Setting up email authentication for a custom domain linked to Outlook.com to prevent outgoing emails from bouncing or being marked as spam by strict providers like Gmail.
- Observed behavior
- Without these DNS records, custom domain emails sent via Outlook.com fail authentication checks and are often rejected or routed to the recipient's junk folder.
Ensure you have administrator access to both your Microsoft 365/Outlook admin portal and the DNS management dashboard of your domain registrar (e.g., GoDaddy, Namecheap, Cloudflare).
Add Authentication Records via Domain Registrar
Implement SPF, DKIM, and DMARC by adding specific TXT and CNAME records to your domain's DNS settings.
Email authentication relies on domain name system (DNS) records to prove to receiving servers that an email genuinely came from you. You must configure these records at your domain registrar, following Microsoft's specific parameter requirements.
Log into your domain registrar's DNS settings. Add a new TXT record for your domain (usually using '@' as the hostname). For Microsoft 365/Outlook, the standard value is typically 'v=spf1 include:spf.protection.outlook.com -all'. Save the record.
Go to the Microsoft 365 Defender portal under 'Email & collaboration' > 'Policies & rules' > 'Threat policies' > 'Email authentication settings' > 'DKIM'. Select your domain and create DKIM keys. Copy the generated CNAME records and add them to your domain registrar's DNS settings, then return to Microsoft to enable DKIM.
In your domain registrar's DNS settings, add a new TXT record with the hostname '_dmarc'. To start safely without blocking legitimate emails, use the value 'v=DMARC1; p=none;'. This 'p=none' policy will monitor your traffic and send reports without rejecting emails that fail checks.
Boost Your Productivity with WPS Office
While you are managing your domain and Outlook settings, consider upgrading your desktop document workflow. WPS Office is a powerful, lightweight, and free alternative to Microsoft Office that provides a highly compatible environment for your everyday tasks.
- 1. Download the Installer: Visit the official WPS Office website and click 'Download WPS Office Free' to get the installer for your operating system.
- 2. Install the Suite: Run the downloaded file and follow the simple on-screen instructions to install the software in seconds.
- 3. Open Your Office Files: Launch WPS Office and instantly open your existing Word, Excel, and PowerPoint files without worrying about formatting issues.
Frequently Asked Questions
Why are my Outlook emails going to Gmail spam?
Providers like Gmail enforce strict authentication policies. If your custom domain lacks properly configured SPF, DKIM, and DMARC records, Gmail cannot verify you as the legitimate sender and will likely route your emails to the spam folder or reject them entirely.
What does p=none mean in a DMARC record?
The 'p=none' tag is a monitoring policy. It tells receiving email servers to treat messages normally even if they fail authentication checks, while still sending reports back to you. This is highly recommended when first setting up DMARC so you can troubleshoot configuration issues before moving to stricter 'quarantine' or 'reject' policies.
How can I verify if my SPF and DKIM records are working?
You can use free online DNS lookup tools like MXToolbox or Google's Admin Toolbox to check your domain's TXT records. Additionally, sending a test email to a service like Mail-Tester can give you a detailed report on whether your SPF, DKIM, and DMARC signatures are passing.
