DNS help › Microsoft 365
Microsoft 365: where to set up DKIM, SPF and DMARC
If your business email runs on Microsoft 365 (Outlook and Exchange Online) with your own domain, Microsoft doesn't sign your email with DKIM for your domain until you switch it on. This guide shows where the settings are and where the records go.
Where the records go
Microsoft 365 doesn't host your DNS. You add the records at your DNS provider, usually where you bought the domain. Our guides show how to add TXT and CNAME records at each one:
Where to find DKIM in Microsoft 365
You need a Microsoft 365 admin account with access to the Microsoft Defender portal. DKIM is on the DKIM tab of the Email authentication settings page at security.microsoft.com/authentication (the long way round is Email & collaboration > Policies & rules > Threat policies > Email authentication settings).
Microsoft 365 uses two CNAME records for DKIM, with values that are unique to your organisation and shown in the portal. Both records are needed. On Cloudflare, CNAME records for DKIM must be set to DNS only (grey cloud). The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.
SPF for Microsoft 365
Your SPF record needs to include Microsoft 365 and every other service that sends email as you. A domain can only have one SPF record, so if you already have one, it needs editing rather than adding another. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.
DMARC
DMARC tells receivers what to do with email that fails SPF and DKIM. Start by just watching, then tighten it once your genuine email passes. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.
Get your exact fixes
Every domain is set up a little differently, so the safest fix is one written for yours. The £29 full report lists every issue on your domain, with the exact records to add and step-by-step fixes.
Or choose Monitoring at £19/month: your full report included when you sign up, then we check your domain every week and only email you if something new goes wrong. It has a 2-month minimum, then you can cancel any time.
Not sure yet? Run the free check first to see your top issues, or compare plans.
Check it worked
Microsoft says DNS changes typically take about 15 minutes, but they can take longer. Once you think the change has gone through:
- Go to the free Tidy Cyber check and enter your domain.
- Look at your results. The issue you fixed should no longer appear in your top issues (or should show a lower risk).
- If nothing has changed, wait a little longer and check again. If it still hasn't changed after a day, check the record's Name and Value character by character. A missing character or a doubled domain name is the usual cause.
The free check is passive: it only looks at what your domain already shows the world, and nothing is installed.
Official Microsoft help
We checked these details against Microsoft's guides in October 2026. If the portal looks different, follow Microsoft's own instructions: