Microsoft 365: DKIM Selector & SPF Setup

Microsoft 365 DKIM setup

Microsoft Defender portal → Email & collaboration → Policies → Email authentication settings → DKIM. Enable signing for your domain; Microsoft gives you two CNAME records — selector1._domainkey and selector2._domainkey — pointing at *.onmicrosoft.com targets.

M365 rotates between selector1 and selector2 automatically — both CNAMEs must stay in DNS forever, and only one will show a valid key at any moment. A "missing" selector2 while selector1 validates is normal.

Microsoft 365 SPF record

Your SPF TXT record on the root domain must contain include:spf.protection.outlook.com. A minimal correct record: v=spf1 include:spf.protection.outlook.com ~all. Stacking multiple ESPs? Each include costs DNS lookups against the limit of 10 — count yours here.

Verify all three pillars

DKIM alone doesn't inbox. Run the full domain grade to confirm SPF, DMARC, MX and blacklist status in one shot — Gmail and Microsoft require alignment across all of them for cold outreach in 2026.