Microsoft 365 DMARC Policy
For Microsoft 365 organizations, DMARC policy still lives in DNS. Roll out carefully while Exchange Online and all third-party senders are aligned.
What to configure
Start p=none, fix SaaS senders visible in reports, stage quarantine, then reject. Keep Microsoft DKIM enabled throughout.
v=DMARC1; p=none; rua=mailto:[email protected]
; ensure M365 DKIM enabled + SPF include presentCommon M365 pitfalls
Assuming the Microsoft 365 admin center publishes DMARC; forgetting printer/scanner SMTP; adding too many ESP includes; disabling DKIM after domain changes.
Validation steps
Send external test messages, inspect Authentication-Results, run DMARC/SPF/DKIM checkers, and confirm aggregate reports arrive.
How QuickDMARC helps
QuickDMARC monitors M365 domains, highlights unaligned SaaS, and supports Managed DMARC for policy changes without ticket ping-pong.
Frequently asked questions
Does Microsoft host my DMARC record?
No. You publish _dmarc at your DNS provider.
Is SPF include enough?
No. Enable DKIM and publish DMARC with reporting.
Deep-dive setup?
See the Microsoft 365 DMARC setup guide.