SPF record for Microsoft 365

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Microsoft 365 only

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Microsoft 365 and Google Workspace (for example during a migration)

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all

Microsoft 365 and your own on-premises server (Exchange hybrid)

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all

Replace 203.0.113.10 with the public IP address your server sends from.

GCC High and DoD tenants

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.office365.us -all

Microsoft 365 operated by 21Vianet

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:spf.protection.partner.outlook.cn -all

How SPF applies to Microsoft 365 mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Microsoft 365 sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• Your onmicrosoft.com domain needs nothing: Microsoft publishes and maintains its SPF record, and you can't change it.
• Each subdomain you send from needs its own SPF record. The record on contoso.com doesn't cover marketing.contoso.com.
• Microsoft advises against replacing its include with IP addresses ("flattening"), because its sending addresses change often.

How to add it

1. Sign in to the company that hosts your DNS (often your domain registrar). There is no SPF setting inside Microsoft 365 itself.
2. Look for an existing TXT record on the domain (host @) that starts with v=spf1.
3. If there is one, add include:spf.protection.outlook.com to it, right after v=spf1. If there isn't, create a TXT record with the value for your cloud above.
4. Microsoft recommends a TTL of at least 3600 seconds (one hour) for the SPF record.
5. Save, wait for DNS to update, then check the live record with the SPF Checker below.

DKIM and DMARC alignment

Microsoft says SPF alone is not enough and recommends DKIM and DMARC for every custom domain. It recommends -all because DMARC then decides what happens to failing mail, and notes that with ~all the DMARC policy is effectively ignored for messages that fail SPF and have no DKIM signature. Turn on DKIM signing for your domain (see our DKIM setup guide for Microsoft 365 and Google Workspace), then publish a DMARC record.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Microsoft 365's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Microsoft 365's documentation uses -all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Common syntax errors Microsoft lists: a trailing period (include:spf.protection.outlook.com.), an equals sign instead of a colon (include=), and a space after the colon.