# SPF record for Microsoft 365

URL: https://iblockspam.com/spf/microsoft-365
Last updated: 2026-10-09

Include: include:spf.protection.outlook.com
Where it goes: Your domain (@)
DNS lookups: 1 of 10

For a custom domain in Microsoft 365 (formerly Office 365), where Exchange Online sends your mail, publish one TXT record on the domain itself: v=spf1 include:spf.protection.outlook.com -all. The include costs 1 of your 10 DNS lookups. GCC High and DoD tenants use include:spf.protection.office365.us, and Microsoft 365 operated by 21Vianet uses include:spf.protection.partner.outlook.cn. Microsoft recommends -all.

## Example records

- Microsoft 365 only (TXT, host @): `v=spf1 include:spf.protection.outlook.com -all`
- Microsoft 365 and Google Workspace (for example during a migration) (TXT, host @): `v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all`
- Microsoft 365 and your own on-premises server (Exchange hybrid) (TXT, host @): `v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all` Replace 203.0.113.10 with the public IP address your server sends from.
- GCC High and DoD tenants (TXT, host @): `v=spf1 include:spf.protection.office365.us -all`
- Microsoft 365 operated by 21Vianet (TXT, host @): `v=spf1 include:spf.protection.partner.outlook.cn -all`

## Notes

- Your `onmicrosoft.com` domain needs nothing: Microsoft publishes and maintains its SPF record, and you can't change it.
- Each subdomain you send from needs its own SPF record. The record on `contoso.com` doesn't cover `marketing.contoso.com`.
- Microsoft advises against replacing its include with IP addresses ("flattening"), because its sending addresses change often.

## How to add it

- Sign in to the company that hosts your DNS (often your domain registrar). There is no SPF setting inside Microsoft 365 itself.
- Look for an existing TXT record on the domain (host `@`) that starts with `v=spf1`.
- If there is one, add `include:spf.protection.outlook.com` to it, right after `v=spf1`. If there isn't, create a TXT record with the value for your cloud above.
- Microsoft recommends a TTL of at least 3600 seconds (one hour) for the SPF record.
- Save, wait for DNS to update, then check the live record with the SPF Checker below.

## DKIM and DMARC

Microsoft says SPF alone is not enough and recommends DKIM and DMARC for every custom domain. It recommends `-all` because DMARC then decides what happens to failing mail, and notes that with `~all` the DMARC policy is effectively ignored for messages that fail SPF and have no DKIM signature. Turn on DKIM signing for your domain (see our [DKIM setup guide for Microsoft 365 and Google Workspace](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace)), then publish a [DMARC record](https://iblockspam.com/blog/dmarc-record-examples).

## Common mistakes

- Common syntax errors Microsoft lists: a trailing period (`include:spf.protection.outlook.com.`), an equals sign instead of a colon (`include=`), and a space after the colon.

**Q: What is the SPF record for Microsoft 365?**
For the worldwide service and GCC, it is `v=spf1 include:spf.protection.outlook.com -all`, published as a TXT record on your custom domain. If other services send mail as your domain, add their includes to the same record instead of creating a second one.

**Q: Should Microsoft 365 use -all or ~all?**
Microsoft recommends `-all` (hard fail) for Microsoft 365 domains, together with DKIM and DMARC. Its reasoning: DMARC treats both as SPF failures, but with `~all` the DMARC policy is effectively ignored for messages that also lack a DKIM signature. Our [soft fail vs hard fail guide](https://iblockspam.com/blog/spf-softfail-vs-hardfail) covers the trade-offs.

**Q: Is the Office 365 SPF record the same?**
Yes. Microsoft renamed most Office 365 plans to Microsoft 365, and Exchange Online still sends the mail, so guides that mention the Office 365 SPF record give the same value: `v=spf1 include:spf.protection.outlook.com -all`. Only GCC High, DoD and 21Vianet tenants use a different include, shown above.

**Q: Do I need an SPF record for my onmicrosoft.com domain?**
No. Microsoft owns `onmicrosoft.com`, so it creates and maintains the SPF record for your `contoso.onmicrosoft.com` domain. You only publish SPF for custom domains you add to Microsoft 365.

Sources:
- Microsoft Learn: Set up SPF to identify valid email sources for your Microsoft 365 domain: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure

---

Source: iBlockSpam, https://iblockspam.com/spf/microsoft-365 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt