How do I set up SPF for Microsoft 365?
Publish one TXT record at your domain that starts v=spf1, includes spf.protection.outlook.com and ends -all. If other services send email as you, add their includes inside that same record. Microsoft recommends -all for Microsoft 365 domains. The record is made at your DNS host, not in Microsoft 365.
Last read from the sources at the foot of this page.
What does Microsoft say?
Microsoft gives the include every Microsoft 365 domain needs.
Most Microsoft 365 organizations require include:spf.protection.outlook.com in the SPF TXT record for the domain.
For Microsoft 365 domains, we recommend -all (hard fail) because we also recommend DKIM and DMARC for the domain.
What record do I publish?
If Microsoft 365 is the only service sending as your domain, publish this record.
v=spf1 include:spf.protection.outlook.com -allWhat are the steps?
Each defined domain or subdomain in DNS requires an SPF TXT record, and only one SPF record is allowed per domain or subdomain.
SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS.
- Look up your domain's TXT records.If one already starts v=spf1, edit it. Do not add a second.
- Make sure it contains include:spf.protection.outlook.com.
- Add an include for each other service that sends as you, inside the one record you have.
- End the record with -all.
An SPF record may make at most 10 DNS lookups. Each include counts toward the limit.
Where is the change made?
Your DNS settings, at the company that holds your domain or runs its DNS. Microsoft says the record is made there.
Instead, you create the SPF TXT record at your domain registrar or DNS hosting service (often the same company).
What else do people ask about this?
Do I need SPF for my onmicrosoft.com domain?
No. Microsoft says the SPF record for the onmicrosoft.com domain is already set up for you.
Should I use -all or ~all with Microsoft 365?
Microsoft recommends -all for Microsoft 365 domains. DMARC treats both as a failure, so set up DKIM and DMARC as well.
Where does this come from?
- Microsoft Learn, Set up SPF to identify valid email sources for your Microsoft 365 domainlearn.microsoft.comRead 16 October 2026
- RFC 7208, Sender Policy Framework (SPF)rfc-editor.orgRead 16 October 2026
See what is open before anyone else does.
We read your domain from outside and show each way in with a check anyone can re-run.