'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix SPF, DKIM, and DMARC DNS Entries in Microsoft 365
Question details
The user needs to correct Microsoft 365 email authentication warnings by properly configuring SPF, DKIM, and DMARC DNS records.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Configuring domain DNS records to authenticate emails and prevent spam or spoofing warnings.
- Observed behavior
- Email authentication warnings are triggered due to missing or incorrect DKIM selector records and DMARC configurations.
Ensure you have administrator access to the Microsoft 365 Defender portal and the DNS management console of your domain hosting provider.
Configure DKIM CNAME Records in DNS
Create and publish the exact CNAME records for selector1 and selector2 provided by Microsoft 365 to enable DKIM authentication.
DKIM adds a cryptographic signature to your emails. Microsoft 365 requires you to publish two specific CNAME records in your domain's DNS settings before DKIM can be activated.
Log in to the Microsoft 365 Defender portal, then navigate to Policies & rules > Threat policies > Email authentication settings > DKIM.
Select your domain from the list. The panel will display the exact host names and target values for selector1 and selector2. Copy these values to your clipboard.
Open your domain provider's DNS management page (e.g., GoDaddy, Cloudflare) and create two new CNAME records. Paste the copied host names and target values exactly as they appeared.
Return to the Microsoft 365 Defender portal, wait for DNS propagation to complete, and toggle the switch to 'Enable' DKIM for your domain.
Verify SPF and DMARC Configurations
Ensure your SPF record correctly authorizes Microsoft 365 to send emails and that your DMARC record enforces your organization's email policy.
Looking for a Lightweight and Free Office Suite?
While managing Microsoft 365 requires complex DNS and administrative setups for enterprise email, creating documents shouldn't be difficult. If you only need powerful word processing, spreadsheets, and presentation tools without the expensive enterprise overhead, WPS Office is the perfect free alternative. It offers a familiar interface, seamless migration, and high compatibility with Microsoft Office formats.
- 1. Download the Installer: Visit the official WPS Office website and download the installation file for your operating system.
- 2. Install WPS Office: Run the installer and follow the simple on-screen instructions to set up the lightweight office suite.
- 3. Open Your Documents: Launch WPS Office and instantly open your existing Microsoft Word, Excel, or PowerPoint files with zero formatting loss.
Frequently Asked Questions
How long does it take for Microsoft 365 to recognize my new DKIM and DMARC DNS records?
DNS changes typically propagate within a few hours, but it can take up to 48 hours for Microsoft 365 to fully recognize and validate the new CNAME, SPF, or DMARC records globally.
Why am I getting an error when attempting to enable DKIM in Microsoft 365 Defender?
This usually happens if the CNAME records for selector1 and selector2 are not published correctly in your DNS, or if DNS propagation is still incomplete. Verify that you copied the host names and target values exactly as provided by Microsoft without manually substituting any characters.
Can I use multiple SPF records for a single domain to authorize different email providers?
No, a domain can only have one SPF TXT record. If you use multiple email services, you must merge their SPF includes into a single record (for example: `v=spf1 include:spf.protection.outlook.com include:thirdparty.com -all`).
What happens if I don't configure DMARC for my Microsoft 365 domain?
Without DMARC, your domain is more susceptible to email spoofing and phishing attacks. Additionally, strict email service providers like Gmail and Yahoo may flag your outgoing Microsoft 365 emails as spam or reject them entirely.
