# SPF record for Dynamics 365 Customer Insights - Journeys

URL: https://iblockspam.com/spf/dynamics-365-customer-insights
Last updated: 2026-10-22

Include: None needed (optional: your envelope-from domain)
Where it goes: Not needed (envelope-from CNAME)
DNS lookups: depends on your account

Dynamics 365 Customer Insights - Journeys covers SPF through its domain authentication wizard: the last CNAME record sets up the envelope-from (Return-Path) domain, which gives SPF protection and alignment. Microsoft says this meets the RFCs. Only for providers that check SPF on the From address does it suggest adding include:<your envelope-from domain>.

## Example records

- Your main domain on Microsoft 365 stays as it is (TXT, host @): `v=spf1 include:spf.protection.outlook.com -all`
- Optional: Microsoft 365 plus the envelope-from domain from the wizard (TXT, host @): `v=spf1 include:spf.protection.outlook.com include:ind.pb-dynmktga.com -all` `ind.pb-dynmktga.com` is the value in Microsoft's screenshot. Use the envelope-from value your own wizard shows.

## Notes

- Microsoft's troubleshooting article says DNS records can take up to 24 hours to update, depending on the provider.
- If the domain already has a CNAME, so it can't hold a TXT record, Microsoft lets you prove ownership with a TXT record at `dynmktown.<your domain>` instead.
- New instances come with a pre-authenticated `dyn365mktg.com` sending domain, which Microsoft says is only for testing.

## How to add it

- In Customer Insights - Journeys, go to Settings, Email marketing, Domain authentication and select New.
- Enter the domain exactly as it appears in your From addresses (for `lamar.ferrari@contoso.com`, that is `contoso.com`) and choose email sending.
- Add the records the wizard gives you in order: an ownership TXT record, two DKIM CNAMEs (CNAME1 and CNAME2), then the envelope-from CNAME for SPF.
- Select Verify. When each record has a green check mark and the status is Confirmed, the domain is ready.
- Only if a receiver bounces mail on SPF for the From domain, add the include for your envelope-from domain to your existing SPF record.

## DKIM and DMARC

The wizard's CNAME1 and CNAME2 are the DKIM records (Microsoft's example host is `namkey1._domainkey`); see our [Dynamics 365 Customer Insights DKIM page](https://iblockspam.com/dkim/dynamics-365-customer-insights). Messages from an unauthenticated domain fail the error check, so authenticate every domain you use in From addresses.

## Common mistakes

- Authenticating `www.contoso.com` when your addresses are `@contoso.com`. Microsoft treats them as different domains.
- Copying the envelope-from include from Microsoft's screenshot instead of your own wizard.
- Using the built-in `dyn365mktg.com` domain for production mail.

**Q: Do I need an SPF include for Dynamics 365 Customer Insights - Journeys?**
Not for standards-compliant receivers. The envelope-from CNAME in the domain authentication wizard covers SPF and alignment. Microsoft suggests adding `include:` with your envelope-from domain only to avoid bounces from providers that check SPF against the From address.

**Q: Where is domain authentication in Customer Insights - Journeys?**
Under Settings, Email marketing, Domain authentication. Select New to start the wizard, which walks you through an ownership TXT record, two DKIM CNAMEs and the envelope-from CNAME, then select Verify.

**Q: Why does Customer Insights - Journeys change my From address?**
If the From address uses a domain that isn't authenticated, Microsoft changes it to an authenticated domain registered for your instance, such as `MyName@contoso.s01.dyn365mktg.com`. Authenticate your own domain and set it as the default sending domain.

Sources:
- Microsoft Learn: Authenticate your domains (Customer Insights - Journeys): https://learn.microsoft.com/en-us/dynamics365/customer-insights/journeys/domain-authentication
- Microsoft Learn: Fix domain authentication in Customer Insights - Journeys: https://learn.microsoft.com/en-us/troubleshoot/dynamics-365/customer-insights/journeys/email/troubleshoot-domain-authentication

---

Source: iBlockSpam, https://iblockspam.com/spf/dynamics-365-customer-insights (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt