Guides › Microsoft 365

Microsoft 365 emails going to spam? Here's the fix

If quotes, invoices or replies you send from Outlook land in your customers' spam folders, the cause is usually a setting Microsoft leaves off: DKIM for your own domain.

The short answer

When you add your own domain to Microsoft 365, Microsoft doesn't sign your mail with it. It signs with your yourcompany.onmicrosoft.com address instead, which doesn't match the you@yourcompany.com your customers see. Gmail, Yahoo and Outlook check that match, called DMARC alignment, to decide whether a message really comes from you. Without it, your mail looks less trustworthy than it should, and since 2024 the big mailbox providers have been much stricter about this.

The fix is three DNS changes: turn on DKIM for your domain, make sure there's one correct SPF record, and add a DMARC record.

Check what's wrong first

Run your domain through the free check. It shows your SPF, DKIM and DMARC records in a few seconds. Then send an email from Outlook to a Gmail address, open it in Gmail (look in spam too), and choose ⋮ → Show original. If DKIM shows onmicrosoft.com instead of your domain, or DMARC says fail or isn't listed, this guide is for you.

How to fix it

1. Turn on DKIM for your domain

1. Sign in to the Microsoft Defender portal at security.microsoft.com as an admin.
2. Go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings, and open the DKIM tab.
3. Select your domain, then Create DKIM keys. Microsoft shows two CNAME records, named selector1._domainkey and selector2._domainkey.
4. At your DNS host (GoDaddy, Squarespace, Cloudflare or wherever your domain's DNS lives), add both CNAME records exactly as shown. Copy the values; they're long and specific to your account.
5. Wait for the records to appear, then go back to the domain in Defender and switch on Sign messages for this domain with DKIM signatures.

If the toggle reports that the records can't be found, wait an hour and try again. The most common mistake is a DNS host that adds your domain name to the end automatically, so the record ends up as selector1._domainkey.yourcompany.com.yourcompany.com.

2. Have one SPF record that lists everything

Your domain needs exactly one TXT record starting with v=spf1. For Microsoft 365 alone it looks like this:

v=spf1 include:spf.protection.outlook.com -all

Anything else that sends email "from" your domain, such as an invoicing tool, booking system, website form or newsletter service, has to be in the same record. Two SPF records, which happens often when a second tool is set up, break SPF completely. So does a record that needs more than 10 DNS lookups.

3. Add a DMARC record

Add a TXT record named _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

p=none tells mailbox providers to report what they see without blocking anything, so it's safe to start with. After a couple of weeks of clean reports, move to p=quarantine, so mail that pretends to be you goes to spam while yours goes to the inbox.

4. Test again

Send another email to Gmail and check Show original: SPF, DKIM and DMARC should all say PASS, and DKIM should show your own domain.

Still landing in spam?

If all three pass and mail still goes to spam, look at the other tools sending as your domain: each one needs its own DKIM setup too, and one badly set up sender can drag down the whole domain. Also check what you send. Messages with only a link, a large attachment, or a forwarded chain of old replies get filtered more often. And after a period of problems, it can take a few days of normal sending before Gmail and Outlook trust the domain again.

Questions

Why are my Microsoft 365 emails going to spam?

Most often because DKIM isn't turned on for your own domain. Microsoft 365 signs your mail with your onmicrosoft.com domain by default, which doesn't match your From address, so Gmail and Yahoo can't tie the message to your business. A missing DMARC record, or an SPF record that leaves out other tools that send as you, are the next most common causes.

Is DKIM on by default in Microsoft 365?

Only for your onmicrosoft.com address. For your own domain, you create the DKIM keys in the Microsoft Defender portal, publish two CNAME records at your DNS host, and then switch signing on. Until you do, your mail has no DKIM signature from your own domain.

What SPF record does Microsoft 365 need?

One TXT record at your domain that includes spf.protection.outlook.com, for example v=spf1 include:spf.protection.outlook.com -all. If other services send as your domain, such as an invoicing tool or website, they go in the same record. A domain must have only one SPF record; two break SPF completely.

How long does the fix take to work?

The DNS changes usually take effect within an hour, though they can take longer at some DNS hosts. After that, new mail passes DKIM and DMARC straight away. Getting out of spam folders at Gmail or Outlook can take a few days of normal sending, as mailbox providers learn to trust the domain again.

Related: Google Workspace emails going to spam · contact form emails going to spam.