Microsoft 365 signs mail from your .onmicrosoft.com domain automatically, but not from your own domain until you publish two CNAME records and switch DKIM on. Until then, mail from you@yourcompany.com can't pass DMARC through DKIM.
SPF
| Type | Name (host) | Value |
|---|---|---|
| TXT | @ | v=spf1 include:spf.protection.outlook.com -all |
Microsoft's own guidance ends the record in -all. If other tools also send as you, add their includes to this one record.
DKIM
- Open the Defender portal at
security.microsoft.com/authentication(Email & collaboration > Policies & rules > Threat policies > Email authentication settings) and choose the DKIM tab. - Click your domain. The flyout shows two CNAME records to publish.
- Add both at your DNS host, copying the values exactly as shown:
| Type | Name (host) | Value |
|---|---|---|
| CNAME | selector1._domainkey | selector1-yourcompany-com._domainkey.yourtenant.n-v1.dkim.mail.microsoft |
| CNAME | selector2._domainkey | selector2-yourcompany-com._domainkey.yourtenant.n-v1.dkim.mail.microsoft |
- Back in the flyout, switch the DKIM toggle from Disabled to Enabled. If the portal says it can't find the CNAMEs yet, wait for DNS to update and try again.
The target format changed in May 2025. Domains added since then get targets ending in dkim.mail.microsoft, with a one-letter partition code such as n-v1 that Microsoft assigns. Older domains keep targets ending in onmicrosoft.com. Don't rebuild these by hand, and don't add .com after dkim.mail.microsoft; some DNS hosts do that if you aren't careful.
Key size and rotation
New Microsoft 365 DKIM keys are 1024-bit by default. They pass, but 2048-bit is the current recommendation. You can rotate to a 2048-bit key in Exchange Online PowerShell with Rotate-DkimSigningConfig -Identity yourcompany.com -KeySize 2048. The new key takes four days (96 hours) to start signing, so expect the old selector to keep appearing in headers until then.
DMARC
Once SPF and DKIM both pass, publish DMARC. Start at p=none with a report address you actually read:
| Type | Name (host) | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com |
After two to four weeks of clean reports, move to p=quarantine, then p=reject. The safe route to enforcement covers what to look for.
One more: if your domain's MX doesn't point straight at Microsoft (for example, mail passes through a separate filtering service first), check that service's own DMARC guidance. Inbound filtering in front of Microsoft 365 can break the SPF results Microsoft sees.
Questions people ask
Where's DKIM in the old Exchange admin center?
Microsoft moved it to the Defender portal. The direct page is security.microsoft.com/authentication, DKIM tab.
Why are there two selectors?
So Microsoft can rotate keys. One selector signs while the other holds the next key. Both CNAMEs must stay published.
Related guides
- How to find your DKIM selector Read it from a message header in a minute, then check the key.
- Moving DMARC from p=none to reject without losing mail The order of steps, how long to wait, and what to look for first.
- Gmail, Yahoo and Outlook sender requirements, in plain English What Gmail, Yahoo and Outlook.com enforce, as a checklist.
DNS only shows part of the picture. If mail is still landing in spam with every record right, the deliverability audit looks at the rest: blocklists, reputation, bounces, content and the sending setup.