Email & DNS guide
DMARC for Microsoft 365 domains
Plan authentication for Microsoft 365 alongside the other services that send mail for your business.
Inventory more than your main mailbox
Microsoft 365 may be your main mail platform while invoices, newsletters and support replies come from other providers. List them before editing DNS. Record which visible From domain each service uses so you can verify its alignment separately.
Configure your custom domain
Follow Microsoft's current instructions for SPF and DKIM on each custom sending domain. Use the DNS values displayed for your own tenant; do not copy another organization's selector targets. A provider's default domain configuration is not a substitute for checking your custom From domain.
Publish and review DMARC
Start with a reporting plan, confirm aligned authentication for legitimate senders, and introduce an enforcement policy after investigating failures. Microsoft recommends configuring SPF and DKIM before DMARC. Keep reporting access and DNS ownership with a responsible administrator.
Verify at the receiving end
Send fresh messages from a Microsoft 365 mailbox and each third-party platform to an external mailbox. Compare Authentication-Results with the visible From address. Recheck after tenant migrations, provider changes and DKIM rotations; a DNS check alone cannot confirm message handling.
Primary references
Provider dashboards and instructions can change. Confirm current values with your provider before editing DNS.