How do I add an SPF record at Wix for Microsoft 365?
Publish one TXT record at your domain itself with the value v=spf1 include:spf.protection.outlook.com -all. If you already have an SPF record, add include:spf.protection.outlook.com to it instead of adding a second one: two SPF records make the check fail.
Last read , from the sources at the foot of this page.
What does an SPF record do?
It lists the services allowed to send mail as your domain. A mail server reads it to decide whether a message really came from one of them.
What record do I publish for Microsoft 365?
This is the record when Microsoft 365 is the only service that sends your mail. Microsoft recommends ending with -all for a Microsoft 365 domain, because it also recommends DKIM and DMARC.
v=spf1 include:spf.protection.outlook.com -allHow do I add it at Wix?
- Sign in to Wix and go to Domains.
- Click the Domain Actions icon beside your domain and select Manage DNS Records.
- Click + Add Record in the TXT section.
- Leave Host Name empty, which means the domain itself.
- Paste the record in Value, exactly as copied.
- Click Save.
This works when your domain is connected to Wix by name servers. If it is connected by pointing, add the record at the company that holds the domain instead.
In our words, from Wix: adding a TXT record, read 14 October 2026. If a screen has changed since, follow the host's own page.
What if I already have an SPF record?
Keep one record. Add include:spf.protection.outlook.com to the record you have, before its last word, and keep every service already in it. More than one SPF record makes the check fail for every message.
An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10, the check fails, so remove services you no longer use before adding new ones.
Where does this come from?
- Microsoft: Set up SPF for your Microsoft 365 domainRead 14 October 2026
- Wix: adding a TXT recordRead 14 October 2026
- RFC 7208, Sender Policy Framework (sections 4.5 and 4.6.4)Read 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/