Microsoft 365 email authentication needs to match your actual domain and sending services. A copied example can be wrong even when it looks similar to your tenant’s records.
Map who sends mail
List Microsoft 365, website forms, marketing platforms and any other legitimate senders. Check the current DNS and ownership of the change. Do not replace an existing SPF record without accounting for the other services it authorises.
Obtain your exact DKIM values
In Microsoft Defender’s email authentication settings, select your domain and inspect the DKIM details. Copy both CNAME values from that domain’s Publish CNAMEs section, or obtain them through the documented administrative command. Do not construct them from an old template: Microsoft has introduced newer target formats.
Publish, enable and check
Enter the records in the correct DNS zone, taking care not to duplicate the domain suffix. After Microsoft detects them, enable signing for that domain and confirm its status. Separate subdomains and sending tools may need their own arrangements.
Treat DMARC as a planned policy
Review alignment, reporting and every authorised sender before moving to an enforcement policy. Authentication records are related, but adding a TXT record is not a guarantee that all mail will arrive or that every sender has been accounted for.
For help reviewing the setup, explore email security and deliverability. Do not post account credentials in a support request.
Sources and further reading
Guidance checked 26 October 2026: Microsoft’s current DKIM configuration guidance; Microsoft’s email-authentication overview.
Illustrations
