Thursday, September 24, 2026

Set Up DMARC for Microsoft 365 Hosted Email

 


How to Set Up DMARC for Microsoft 365:
Stop Email Spoofing for Good!

If you own a custom domain, email security isn't optional anymore. Major email providers like Google, Yahoo, and Microsoft strictly require authentication records to ensure your emails reach the inbox instead of the spam folder.

Setting up DMARC (Domain-based Message Authentication, Reporting, and Conformance) prevents scammers from impersonating your business while boosting your overall email deliverability.

Here is a step-by-step guide to properly setting up DMARC alongside SPF and DKIM for Microsoft 365 (formerly Office 365).


The Email Security Trinity Explained

Before touching DNS settings, it helps to understand how the three main authentication tools work together:

  1. SPF (Sender Policy Framework): A public list in your DNS of every server or service allowed to send email from your domain.

  2. DKIM (DomainKeys Identified Mail): A digital signature attached to outgoing emails proving the message wasn't tampered with in transit.

  3. DMARC: The instructions you give receiving servers on what to do if an email fails SPF or DKIM alignment (e.g., monitor, spam-folder, or reject completely).


Step 1: Verify Your SPF and DKIM Records First

DMARC requires at least one of the other two protocols (SPF or DKIM) to be active and passing. For full security, set up both.

Check Your SPF Record

Log in to your DNS host (e.g., GoDaddy, Cloudflare, Namecheap) and ensure you have a TXT record pointing to Microsoft 365.

  • Host/Name: @ (or leave blank depending on your registrar)

  • Value for Microsoft 365: v=spf1 include:spf.protection.outlook.com -all

Enable Your DKIM Keys

Microsoft 365 handles DKIM slightly differently than Google by using two CNAME records instead of a single TXT record:

  1. Log in to the Microsoft Defender Portal (security.microsoft.com) or Exchange Admin Center.

  2. Navigate to Email & Collaboration > Policies & Rules > Threat Policies > Email authentication settings (or search for DKIM).

  3. Select your domain name from the list.

  4. Microsoft will display two CNAME hostnames (usually selector1._domainkey and selector2._domainkey) and two target values.

  5. Go to your DNS host and add both CNAME records using the exact names and targets provided by Microsoft.

  6. Return to Microsoft Defender / Exchange Admin and toggle the switch to Enable DKIM keys.

Crucial Step: Once the CNAME records are saved in your DNS, return to Microsoft's portal and flip the toggle switch to Enable. Microsoft will not sign your emails until this is activated in the portal.


Step 2: Add Your DMARC Record

Navigate to your DNS host's management page and add a new TXT record with the following details:

  • Type: TXT

  • Name / Host: _dmarc (Common Trap: Enter ONLY _dmarc. Many DNS providers automatically append your domain name. Typing _dmarc.yourdomain.com will break the record.)

  • Value / Text: v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@yourdomain.com (Replace the email address with where you'd like to receive daily XML delivery reports.)

  • TTL: 1 Hour or Auto


Step 3: Understand the Phased DMARC Rollout Strategy

Flipping DMARC straight to maximum protection (p=reject) can accidentally block legitimate outgoing emails if a third-party service (like Mailchimp, QuickBooks, or a web form) isn't authenticated yet.

Use a phased approach to safely ramp up enforcement:

Phase 1: Monitoring Mode (p=none)

  • Record Value: v=DMARC1; p=none; rua=mailto:you@yourdomain.com

  • What it does: Collects delivery reports without altering email delivery.

  • Duration: Run for 1–2 weeks to verify all valid sending sources are identified.

Phase 2: Gradual Quarantine (p=quarantine with pct)

  • Record Value: v=DMARC1; p=quarantine; pct=25; rua=mailto:you@yourdomain.com

  • What it does: Applies spam protection to 25% of failing emails while passing the other 75% for testing.

  • Next Steps: Slowly increase pct=25 to pct=50 to pct=100 over a few weeks.

Phase 3: Total Enforcement (p=reject)

  • Record Value: v=DMARC1; p=reject; rua=mailto:you@yourdomain.com

  • What it does: Receiving servers will flat-out drop/block any email failing authentication before it ever touches a user's inbox.

  • Goal: Maximum defense against domain spoofing and phishing attacks.


Step 4: Test and Verify Your Setup

Once all records are saved and propagation has finished (usually 15–30 minutes):

  1. Send a test email from your custom Microsoft 365 address to a personal Gmail account.

  2. Open the email in Gmail, click the three dots in the top-right corner, and select Show original.

  3. Look at the top summary header. You should see an explicit PASS next to all three fields:

  • SPF: PASS with IP...

  • DKIM: PASS with domain yourdomain.com

  • DMARC: PASS

If all three show PASS, your domain is fully authenticated, compliant with modern email security standards, and protected against identity spoofing.



Created & Maintained by Pacific Northwest Computers



📞 Pacific Northwest Computers offers Remote & Onsite Support Across: 

SW Washington including Vancouver WA, Battle Ground WA, Camas WA, Washougal WA, Longview WA, Kelso WA, and Portland OR 

Posted by at
Labels: , , , , , , , , , , , , , , , , , , ,

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)