SPF record for Dynamics 365 Customer Insights - Journeys

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Optional: Microsoft 365 plus the envelope-from domain from the wizard

Type: TXT · Host: @ Copy

v=spf1 include:spf.protection.outlook.com include:ind.pb-dynmktga.com -all

ind.pb-dynmktga.com is the value in Microsoft's screenshot. Use the envelope-from value your own wizard shows.

How SPF applies to Dynamics 365 Customer Insights mail

Dynamics 365 Customer Insights sends with a bounce (MAIL FROM) address on a subdomain set up for it, and receivers check SPF on that subdomain. Your main domain's SPF record doesn't need to change for Dynamics 365 Customer Insights. Microsoft's optional extra is an include for the envelope-from domain the wizard shows, for the few receivers that check SPF against the From address.

• Microsoft's troubleshooting article says DNS records can take up to 24 hours to update, depending on the provider.
• If the domain already has a CNAME, so it can't hold a TXT record, Microsoft lets you prove ownership with a TXT record at dynmktown.<your domain> instead.
• New instances come with a pre-authenticated dyn365mktg.com sending domain, which Microsoft says is only for testing.

How to add it

1. In Customer Insights - Journeys, go to Settings, Email marketing, Domain authentication and select New.
2. Enter the domain exactly as it appears in your From addresses (for lamar.ferrari@contoso.com, that is contoso.com) and choose email sending.
3. Add the records the wizard gives you in order: an ownership TXT record, two DKIM CNAMEs (CNAME1 and CNAME2), then the envelope-from CNAME for SPF.
4. Select Verify. When each record has a green check mark and the status is Confirmed, the domain is ready.
5. Only if a receiver bounces mail on SPF for the From domain, add the include for your envelope-from domain to your existing SPF record.

DKIM and DMARC alignment

The wizard's CNAME1 and CNAME2 are the DKIM records (Microsoft's example host is namkey1._domainkey); see our Dynamics 365 Customer Insights DKIM page. Messages from an unauthenticated domain fail the error check, so authenticate every domain you use in From addresses.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Authenticating www.contoso.com when your addresses are @contoso.com. Microsoft treats them as different domains.
• Copying the envelope-from include from Microsoft's screenshot instead of your own wizard.
• Using the built-in dyn365mktg.com domain for production mail.