SentraDMARC

Microsoft 365

How to authorize Microsoft 365 (Exchange Online) for SPF and DKIM.

SPF

Microsoft's SPF include is include:spf.protection.outlook.com.

  • If SentraDMARC hosts your SPF, do not edit the record at your DNS host. Add Microsoft 365 on the SPF page, or press Add to your SPF on the Microsoft sender card on the DMARC page.
  • If you manage SPF yourself, add the include to your existing record, before its ~all or -all.

DKIM

Microsoft 365 signs with two selectors, selector1 and selector2, and gives you a CNAME target for each. Microsoft rotates its own keys behind those targets, so once they are in place nothing needs changing on your side.

  1. Open the Microsoft Defender portal and go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM. Select your domain.
  2. Microsoft shows a CNAME target for each selector. Copy the exact value the portal shows. Older tenants get targets like selector1-example-com._domainkey.<tenant>.onmicrosoft.com; newer domains get targets under dkim.mail.microsoft. Do not build the value by hand.
  3. If SentraDMARC hosts your DKIM: on the DKIM page, choose the Microsoft 365 preset, paste both values, and publish. Then add the two CNAMEs the page shows, at selector1._domainkey and selector2._domainkey on your domain.
  4. If you manage DKIM yourself: add the two CNAMEs pointing straight at Microsoft's targets.
  5. Back in the Defender portal, turn on Sign messages for this domain with DKIM signatures. If the switch refuses, the CNAMEs are not resolving yet; wait for them and try again.