Microsoft 365 SPF
Exchange Online sending typically requires include:spf.protection.outlook.com in your domain SPF record, plus carefully managed includes for other senders.
What to configure
Use a single SPF TXT, include Microsoft's mechanism, avoid blowing the 10-lookup limit when adding ESPs, and verify with an SPF checker.
v=spf1 include:spf.protection.outlook.com -allCommon M365 pitfalls
Assuming the Microsoft 365 admin center publishes DMARC; forgetting printer/scanner SMTP; adding too many ESP includes; disabling DKIM after domain changes.
Validation steps
Send external test messages, inspect Authentication-Results, run DMARC/SPF/DKIM checkers, and confirm aggregate reports arrive.
How QuickDMARC helps
QuickDMARC monitors M365 domains, highlights unaligned SaaS, and supports Managed DMARC for policy changes without ticket ping-pong.
Frequently asked questions
Does Microsoft host my DMARC record?
No. You publish _dmarc at your DNS provider.
Is SPF include enough?
No. Enable DKIM and publish DMARC with reporting.
Deep-dive setup?
See the Microsoft 365 DMARC setup guide.