Microsoft 365 SPF and DMARC for agencies
By Tyler Mayberry · Cirlet. Published . Page updated .
Based on the vendor’s public documentation, checked October 28, 2026. Vendor settings change; your provider should confirm what applies to your account before changing anything.
If Microsoft 365 is the only service that sends your agency’s mail, Microsoft documents this SPF record: v=spf1 include:spf.protection.outlook.com -all. It then recommends DKIM and a DMARC record rolled out from monitoring to rejection.
How agency domains compare
In our October 2026 check, 396 independent agency domains received mail through Microsoft 365. 392 (99%) published one SPF record, 161 (41%) published no DMARC record and 139 (35%) asked receivers to quarantine or reject failing mail. Of those with one SPF record, 290 ended in -all and 98 in ~all.
What Microsoft documents
| SPF record | v=spf1 include:spf.protection.outlook.com -all when Microsoft 365 is the only source of mail. Add other senders’ include: or ip4: values to the same record. |
|---|---|
| Ending | Microsoft recommends -all for Microsoft 365 domains because it also recommends DKIM and DMARC. |
| Limits | One SPF record per domain or subdomain; more than one causes a permanent error. More than 10 DNS lookups also fails SPF. |
| DMARC record | A TXT record at host _dmarc, for example v=DMARC1; p=none; pct=100; rua=mailto:…. Set up SPF and DKIM for every sending domain first. |
| Rollout | Start at p=none and read the reports, move to p=quarantine (optionally in pct= steps), then p=reject. |
| Unused domains | v=spf1 -all and v=DMARC1; p=reject; for domains that never send mail. |
List every service that sends as your domain.
Your agency management system, rater, e-signature tool, newsletter service, payment or billing system and phone system may all send mail that says it is from your domain. Each one needs to be covered by SPF or sign with DKIM for your domain before DMARC moves past monitoring. Ask your provider for that list, with an owner for each sender.
Microsoft 365 questions
What SPF record does an agency on Microsoft 365 need?
If Microsoft 365 is the only sender, Microsoft documents v=spf1 include:spf.protection.outlook.com -all. Each other service that sends as your domain needs adding to the same single record.
Should an agency’s DMARC record start at p=reject?
Not on a domain that sends mail. Microsoft recommends starting at p=none, reading the aggregate reports, then moving to quarantine and reject so legitimate mail is not blocked.
How many agency domains on Microsoft 365 enforce DMARC?
139 of 396 (35%) in our October 2026 check of independent agency domains.