'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix SPF, DKIM, and DMARC Failures in Microsoft 365 Email
Question details
Users are experiencing issues where legitimate emails are quarantined or rejected due to SPF, DKIM, or DMARC authentication failures.
- Product
- Microsoft 365 Email
- Device & OS
- not provided
- Scenario
- Sending outbound emails or receiving inbound messages after switching providers or updating DNS records.
- Observed behavior
- Legitimate messages are being sent to quarantine or outbound emails are being rejected by recipients because the domain fails DNS email authentication checks.
Ensure you have global administrator access to your Microsoft 365 admin center and administrative access to your domain's DNS hosting provider to make necessary record changes.
Verify and Correct DNS Email Authentication Records
Use this method to audit and correct your domain's SPF, DKIM, and DMARC records to ensure they meet Microsoft 365 requirements.
Email authentication failures often occur when a domain has syntax errors, multiple records, or exceeds lookup limits after migrating to a new provider. Correcting your DNS records resolves most quarantine and rejection issues.
Log in to your DNS hosting provider. Verify that your domain has only one TXT record for SPF. Ensure it includes the Microsoft 365 string (e.g., v=spf1 include:spf.protection.outlook.com -all) and any other authorized third-party senders. Remove duplicate SPF records.
Ensure your SPF record does not exceed the absolute limit of 10 DNS lookups. If you have too many 'include' statements for marketing tools or CRMs, consider flattening your SPF record or removing deprecated services.
Go to the Microsoft 365 Defender portal. Navigate to Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM. Ensure DKIM is enabled and the CNAME records are correctly published in your DNS for all sending systems.
While troubleshooting, edit your DMARC TXT record in your DNS host to temporarily use a monitoring policy by changing the tag to p=none (e.g., v=DMARC1; p=none; rua=mailto:your@email.com;). This allows mail to flow while you analyze DMARC reports for failures.
Run a Message Trace and Open a Support Request
Use backend diagnostic tools to track exactly why specific messages are being rejected or quarantined.
Switch to a Lighter, Faster Office Alternative
While resolving complex Microsoft 365 infrastructure and email policies, you don't have to struggle with heavy desktop applications for your daily tasks. WPS Office provides a fully featured, lightweight, and completely free alternative for your document needs.
Frequently Asked Questions
Why are my emails failing SPF checks after switching to Microsoft 365?
This usually happens if your DNS retains your previous email provider's SPF records, resulting in multiple SPF records for one domain. Ensure you have only one SPF TXT record and that it includes 'include:spf.protection.outlook.com'.
How do I check if my DKIM setup is correct?
You can verify your DKIM setup in the Microsoft 365 Defender portal under Email authentication settings. Additionally, you can send a test email to a third-party diagnostic service like MXToolbox or mail-tester to see if the DKIM signature validates successfully.
What does setting DMARC to p=none do?
Setting the DMARC policy to 'p=none' instructs email receivers to monitor your domain's traffic without rejecting or quarantining emails that fail authentication. This is highly recommended during the initial setup or troubleshooting phase.
Can exceeding DNS lookup limits cause SPF failures?
Yes. The SPF protocol restricts the number of DNS lookups to a maximum of 10. If your SPF record contains too many 'include' statements or third-party service authorizations, receivers will stop resolving it, causing the SPF check to fail automatically.
