SPF record for Microsoft 365

Does this page apply to you?

Run this first. Microsoft 365 only matters if it is where your DNS or mail actually lives.

dig +short MX yourdomain.com

Expect: A hostname like yourdomain-com.mail.protection.outlook.com. If it points elsewhere, mail is not hosted at Microsoft.

Specific to Microsoft 365

• A domain that only sends through Microsoft 365 uses include:spf.protection.outlook.com. Microsoft's own guidance ends the record in -all; use ~all while you are still discovering senders.
• Microsoft's include costs one lookup. A third-party sender is merged into the same single record, never added as a second one.
• Your onmicrosoft.com initial domain already has SPF set by Microsoft. You only manage the record for your own custom domain.

What you should end up with

Illustrative values. Use the exact host and value your provider shows you where it generates them.

Type  Name  Value
TXT  @  v=spf1 include:spf.protection.outlook.com -all

What the receiving server does with this record

On every incoming message the receiver reads the domain in the envelope sender (the Return-Path), fetches its TXT records, picks the one that starts v=spf1, and checks whether the sending IP is covered. It is a check on which servers may send for a domain, not on the visible From address; DMARC is what ties the two together.

Mistakes that break it

• Two SPF records. A domain may have exactly one. Publish a second and SPF returns a permanent error, which receivers treat as a failure. Merge instead.
• Over ten lookups. Each include costs a lookup plus whatever is inside it. See the SPF lookup limit.
• A sender missing. Your sequencer, CRM and billing tool all send as your domain and each needs its include in this one record.
• Wrong domain. SPF is not inherited by subdomains. If you send from mail.yourdomain.com, that name needs its own record.

Check it from the command line

Replace yourdomain.com and look for exactly one line that starts with "v=spf1:

dig +short TXT yourdomain.com