FindLeadEmails
Email intelligence
Try it for free
Mail host · DMARC

DMARC record for Microsoft 365

How to add a DMARC record when DNS or mail is at Microsoft 365. Real steps, then a live lookup.

MX will look like yourdomain-com.mail.protection.outlook.com.

  1. Add TXT at _dmarc.yourdomain.com: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
  2. Watch the aggregate reports for a week or two before tightening the policy.

Official docs: Microsoft 365. Other records for this provider: SPF · DKIM · DMARC

Does this page apply to you?

Run this first. Microsoft 365 only matters if it is where your DNS or mail actually lives.

dig +short MX yourdomain.com

Expect: A hostname like yourdomain-com.mail.protection.outlook.com. If it points elsewhere, mail is not hosted at Microsoft.

Specific to Microsoft 365

  • Microsoft began enforcing authentication requirements for high-volume senders to Outlook.com consumer addresses in 2025: SPF, DKIM and DMARC for senders above 5,000 messages a day.
  • If you are mid-migration from another mail host, stay at p=none until SPF and DKIM pass from every system that still sends as your domain.
  • Use a dedicated mailbox for rua. Reports arrive daily from each provider that saw your mail.

What you should end up with

Illustrative values. Use the exact host and value your provider shows you where it generates them.

Type  Name  Value
TXT  _dmarc  v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

What the receiving server does with this record

When a message arrives, the receiver looks up _dmarc. plus the From domain. DMARC passes when SPF or DKIM passes and the domain that passed matches the From domain. If it fails, the p= policy decides what happens: none does nothing, quarantine sends it to spam, reject refuses it. Either way the receiver can email you an aggregate report.

Mistakes that break it

  • Jumping to `reject`. Start at p=none, read the reports, fix every legitimate sender, then tighten. Enforcing before that loses real mail.
  • Two DMARC records. Like SPF, a domain should have only one.
  • Reports into your inbox. Aggregate reports arrive daily as zipped XML from every provider that saw your mail. Use a dedicated address or a report parser.
  • A `rua` address on another domain. Reports to an external domain are only sent if that domain publishes a record authorizing it.

Gmail and Yahoo have required DMARC from bulk senders since 2024, at a minimum p=none. Build the record with the DMARC generator.

Check it from the command line

dig +short TXT _dmarc.yourdomain.com

Check it live

Check the DMARC record

Look up the live DNS after you save. This tool does not spend credits.

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Publish as TXT at _dmarc.yourdomain.com. Start at p=none until SPF and DKIM pass on real mail.

Related