Email records · Amazon Route 53 · Microsoft 365

How do I add an SPF record at Amazon Route 53 for Microsoft 365?

Publish one TXT record at your domain itself with the value v=spf1 include:spf.protection.outlook.com -all. If you already have an SPF record, add include:spf.protection.outlook.com to it instead of adding a second one: two SPF records make the check fail.

Last read , from the sources at the foot of this page.

Check my firm Read the steps
01

What does an SPF record do?

It lists the services allowed to send mail as your domain. A mail server reads it to decide whether a message really came from one of them.

02

What record do I publish for Microsoft 365?

This is the record when Microsoft 365 is the only service that sends your mail. Microsoft recommends ending with -all for a Microsoft 365 domain, because it also recommends DKIM and DMARC.

SPF for Microsoft 365
v=spf1 include:spf.protection.outlook.com -all
03

How do I add it at Amazon Route 53?

  1. Sign in to the AWS console and open Route 53.
  2. Choose Hosted zones, then choose the zone named for your domain.
  3. Choose Create record, keep Simple routing, and set Record type to TXT.
  4. Leave Record name empty, which means the domain itself.
  5. Paste the record in Value, inside double quotation marks.
  6. Choose Create records.

In our words, from Amazon Route 53: adding a TXT record, read 14 October 2026. If a screen has changed since, follow the host's own page.

04

What if I already have an SPF record?

Keep one record. Add include:spf.protection.outlook.com to the record you have, before its last word, and keep every service already in it. More than one SPF record makes the check fail for every message.

An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10, the check fails, so remove services you no longer use before adding new ones.

Sources

Where does this come from?

DMARC at Amazon Route 53 for Microsoft 365DKIM at Amazon Route 53 for Microsoft 365SPF at Amazon Route 53 for Google WorkspaceEvery DNS host and record
06 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy