Guides › DMARC for Microsoft 365

DMARC record for Microsoft 365

Microsoft 365 doesn't publish a DMARC record for your own domain. You add it at your DNS host, and it only passes once DKIM is turned on for your domain, which Microsoft leaves off by default.

Rather not do this yourself? We find and fix what's sending your email to spam for $199. If there's nothing to fix, you don't pay.

Email us your domain Free check

The record

A DMARC record is one TXT record at your domain's DNS host. For Microsoft 365, start with:

Name:  _dmarc
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

v=DMARC1 says it's a DMARC record. It must come first.
p=none is the policy: report only, block nothing. It's the safe place to start, and it meets Gmail's and Yahoo's requirement that bulk senders publish DMARC.
rua= is where mailbox providers send daily reports about mail using your domain. Use a mailbox you can read, or a DMARC report service.

Some DNS hosts want the name as _dmarc, others as _dmarc.yourcompany.com. If yours adds the domain automatically, entering the full name creates _dmarc.yourcompany.com.yourcompany.com, which doesn't work. Check with the free check after saving.

Where it goes

The record goes at your DNS host, which is wherever your domain's nameservers point: GoDaddy, Squarespace, Cloudflare, Namecheap, IONOS and so on. If you bought the domain through Microsoft, the DNS may be managed in the Microsoft 365 admin center under Settings → Domains.

Before you add it: SPF and DKIM

DMARC passes only when SPF or DKIM passes and matches your From domain. For Microsoft 365 that means:

SPF: one TXT record on your domain that includes include:spf.protection.outlook.com, plus every other service that sends as you.
DKIM: signing turned on for your own domain. It isn't by default. See our Microsoft 365 guide for turning it on in the Defender portal.

DKIM matters most, because it survives forwarding and is the one that usually makes DMARC pass.

Tightening it later

After a couple of weeks, read the reports. Once every real sender passes, including your website, invoicing tool and newsletter service, move to p=quarantine, then p=reject. That's what stops other people sending email as your domain. Our DMARC policy guide walks through it.

What about the onmicrosoft.com domain?

Every Microsoft 365 tenant also has a yourcompany.onmicrosoft.com domain. Microsoft manages its DNS, so you can't add the record at your DNS host. Microsoft recommends adding a DMARC record for it too, through the Microsoft 365 admin center's DNS records for that domain. It matters if any mail goes out from that address.

Want it set up and checked?

We fix it for $199: SPF, DKIM and DMARC for your email provider and every tool that sends as you, real test emails to Gmail, Outlook and Yahoo, and a short report. If there's nothing to fix, you don't pay.

Email us your domain

Questions

What DMARC record should I use for Microsoft 365?

Start with a TXT record named _dmarc with the value v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com. It reports without blocking. Once all your real senders pass, move the policy to quarantine and then reject.

Does Microsoft 365 set up DMARC automatically?

No, not for your own domain. You add the _dmarc TXT record at your DNS host. Microsoft also leaves DKIM off for your own domain until you turn it on in the Defender portal.

Why does DMARC fail for Microsoft 365 mail?

Most often because DKIM isn't turned on for your domain, so Microsoft signs with onmicrosoft.com, which doesn't match your From address. Turn on DKIM for your domain, and make sure your one SPF record includes spf.protection.outlook.com.

Do I need DMARC for the onmicrosoft.com domain?

Microsoft recommends it. Because Microsoft manages that domain's DNS, you add it in the Microsoft 365 admin center rather than at your own DNS host.