If your business uses Microsoft 365 and sends email from your own domain, DMARC setup is now essential for deliverability and trust.
This guide walks you through a safe implementation sequence: SPF, DKIM, then DMARC monitoring and enforcement. The goal is to protect your domain without accidentally blocking legitimate business mail.
You do not need to be deeply technical to follow this checklist, but you should have access to your DNS host and Microsoft 365 admin portals.
Before you start: gather access and sender list
You will need: (1) Microsoft 365 admin access, (2) DNS access for your domain, and (3) a list of every system that sends mail as your domain.
Include finance/invoicing tools, CRM platforms, contact forms, helpdesk systems, newsletter tools, and any custom app SMTP relay. Missing one sender is the most common cause of DMARC rollout issues.
Step 1: Validate or fix your SPF record
In DNS, your domain should have one SPF TXT record. For Microsoft 365-only outbound mail, the baseline usually includes Microsoft's SPF include mechanism (for example, include:spf.protection.outlook.com).
Do not create multiple SPF records. SPF must evaluate to a single record path. If you use third-party senders, their include mechanisms must be merged into the same SPF policy.
Keep SPF under DNS lookup limits (10 mechanism lookups). If your SPF is too large, flattening or sender cleanup may be required.
Step 2: Enable DKIM signing in Microsoft 365
In Microsoft 365 Defender / Exchange settings, enable DKIM for your sending domain. Microsoft will usually require two CNAME records in DNS before DKIM can be enabled.
Publish the required CNAME records exactly as shown in Microsoft 365 for your specific domain. After DNS propagation, return to Microsoft 365 and turn DKIM to enabled.
Confirm that outgoing messages contain a DKIM-Signature header and pass validation in message header analysis tools.
Step 3: Publish a monitoring DMARC record
Start with a monitor-only DMARC policy at _dmarc.yourdomain. A common safe starting point is: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.za; adkim=s; aspf=s; pct=100
This does not reject email yet. It gives you aggregate reports so you can find unauthenticated senders and alignment issues.
Use a dedicated reporting mailbox or DMARC reporting tool so reports are not ignored.
Step 4: Test alignment with real mail flows
Send test messages from each system (Microsoft 365 mailboxes, website form notifications, CRM campaigns, invoice notices, etc.) and inspect authentication results.
You want SPF and/or DKIM to pass with alignment to your visible From domain. If a system cannot align and has no supported fix, do not move to enforcement yet.
Also test high-risk workflows: forwarded messages, shared mailbox sends, delegated sends, and app/device SMTP where relevant.
Step 5: Move policy gradually to quarantine
Once reports and tests are clean, move from p=none to p=quarantine. Some teams also ramp with pct values while monitoring impact.
Track support tickets and bounce patterns during each policy change window. If legitimate mail drops, pause and remediate that sender before tightening again.
Step 6: Enforce with reject (when ready)
After stable quarantine performance and sender cleanup, move to p=reject for stronger anti-spoofing protection.
Keep monitoring DMARC reports continuously. New tools added by marketing or finance can introduce fresh alignment failures if not onboarded correctly.
Common Microsoft 365 DMARC mistakes to avoid
Using multiple SPF records, enabling hard DMARC too early, forgetting third-party senders, not enabling DKIM on all active sending domains, and skipping ongoing report monitoring.
Another frequent issue is assuming "mail sends successfully" means "mail authenticates correctly". Delivery without alignment today can become delivery failure later as provider policies tighten.
Need help with setup and rollout?
If you want a managed implementation, we can configure SPF/DKIM/DMARC for Microsoft 365, validate all senders, and stage policy enforcement safely.
See our Microsoft services, read DMARC Changes: What Businesses Must Do in 2026, or contact us to book a rollout.
Frequently asked questions
Can we go straight to p=reject?
It is risky unless you already have complete visibility and validated sender alignment. Most businesses should start with p=none, then move to quarantine, then reject.
Do we still need SPF if DKIM is enabled?
Yes. SPF and DKIM complement each other. DMARC can pass if one aligns, but best practice is to maintain both correctly for resilience and sender compatibility.
How often should we review DMARC reports?
Weekly at minimum during rollout, then regularly ongoing. Review immediately when new sending platforms are introduced.
A good Microsoft 365 DMARC rollout is less about one DNS record and more about disciplined sender management. SPF, DKIM, and DMARC must work together.
Follow a staged policy path and test every sender before enforcement. If you want help implementing this without disruption, talk to Strand Web.