SPF record for Microsoft 365

• Type: TXT
• Host: @, which means the root of your domain
• Records per domain: one. If you already have an SPF record, merge into it (below).

This is the record for the standard Microsoft 365 service. Government and 21Vianet clouds use a different include: value, which Microsoft lists in its own SPF guide.

What the record says

• v=spf1 marks the record as SPF, version 1.
• include:spf.protection.outlook.com adds Microsoft’s list of sending servers, so mail sent through Microsoft 365 is allowed.
• -all says that any other source is not allowed to send for the domain. Microsoft recommends it for Microsoft 365 domains. ~all is the softer version: accept but mark. See the questions below for when to use which.

Where to add it

Microsoft 365 has no setting for SPF. You add the record where your domain’s DNS is managed, which is often your registrar, such as Namecheap or GoDaddy, or a service like Cloudflare.

1. Sign in there and open the DNS records for your domain.
2. Add a new record of type TXT.
3. Set the host to @ and paste the record as the value. Each subdomain that sends mail needs its own SPF record.
4. Save it. Microsoft suggests a TTL of at least 3600 seconds (one hour).

If you already have an SPF record

Do not add a second one. Merge them into one record: a single v=spf1 at the start, every include: from both records in the middle, and one ending at the end.

For a service you do not control, such as a bulk or outreach sending tool, Microsoft advises using a subdomain with its own record, so a problem with that service does not touch the reputation of your main domain.

Check it

Type your domain into the SPF checker to see the record, that there is only one, and that it ends the way you meant. The SPF record generator has Microsoft 365 as an option if you would rather build the record than edit it by hand. The domain check looks at SPF, DKIM, DMARC and MX in one run.

Common mistakes

• Two SPF records. Merge them into one.
• More than 10 DNS lookups. Each include: counts, and so do the lookups inside it. Over the limit, SPF fails. Individual ip4: and ip6: addresses do not count.
• Typing slips. A full stop after the domain name, include= instead of include:, or a space after the colon all break the record.
• Replacing Microsoft’s include with IP addresses. Microsoft’s sending addresses change often, so keep the include:.
• Forgetting a sender. A CRM, a newsletter tool or a sending service that sends as your domain needs its own include: in the same record, or a subdomain of its own.
• Expecting SPF alone to fix spam. It is one of three records; DKIM and DMARC matter as much.

Next steps

SPF is the first of three records. Next set up DKIM and DMARC with the DKIM and DMARC guide for Microsoft 365. On Google Workspace instead? See the SPF guide for Google Workspace. Microsoft’s own explanation is on Microsoft Learn.