After we published our DMARC setup guides, many clients asked for one practical thing: example records they can use as a starting point.
This article gives safe DMARC pattern examples for Microsoft 365 setups, especially where businesses also send from marketing, CRM, billing, or support platforms.
These are examples, not one-click templates. Your final records must match your exact sender stack and DNS environment.
Example 1: Monitoring-only DMARC starter (recommended first)
Record host: _dmarc.yourdomain.co.za
Value example: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.za; adkim=s; aspf=s; pct=100
Use this when you are still identifying all senders. It enables reporting without enforcement so legitimate mail is not blocked while you clean up alignment.
Example 2: Move to quarantine after cleanup
Value example: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.co.za; adkim=s; aspf=s; pct=100
Use this once SPF/DKIM alignment is consistently healthy across Microsoft 365 and third-party senders. Monitor support tickets and bounces during the first policy window.
Example 3: Strong enforcement with reject
Value example: v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.co.za; adkim=s; aspf=s; pct=100
Use reject only after stable quarantine performance and full sender validation. This gives stronger spoofing protection for your domain.
Microsoft 365 + extra sender stack: what must align
For Microsoft 365, ensure SPF includes Microsoft and DKIM is enabled per sending domain. For every third-party sender (CRM, newsletter, invoicing, helpdesk), publish their required DNS records and confirm alignment with your visible From domain.
A common failure pattern is where mail is "sent successfully" from a tool but fails DMARC alignment. Delivery success alone is not proof of proper authentication.
SPF example pattern (conceptual, not universal)
Many businesses use one SPF TXT record combining Microsoft 365 and approved third-party includes. Keep it to one SPF record only, and stay within lookup limits.
Because provider include values differ by platform and can change, always verify current vendor documentation before publishing updates.
Recommended rollout sequence
1) Fix SPF and enable DKIM everywhere. 2) Publish DMARC with p=none. 3) Review reports and test all systems. 4) Move to quarantine. 5) Move to reject when stable.
This staged path prevents accidental disruption while still getting to a strong end-state.
Troubleshooting checklist
If mail starts failing after policy tightening, check: missing sender DNS entries, DKIM disabled on a domain, tool sending from the wrong From domain, forwarding edge cases, or stale DNS propagation.
Revert temporarily to monitoring only if needed, remediate the root cause, then resume staged enforcement.
Need us to validate your records?
We can audit your Microsoft 365 + third-party sender footprint, publish clean SPF/DKIM/DMARC, and guide policy hardening.
Start with DMARC for Microsoft 365: Step-by-Step DNS Setup, read DMARC Changes: What Businesses Must Do in 2026, or contact us for a rollout review.
Frequently asked questions
Can I copy one DMARC record for every domain?
You can reuse a policy pattern, but every domain still needs sender validation. Different domains often have different tools and alignment requirements.
Should alignment be strict or relaxed?
Strict alignment (adkim=s; aspf=s) is stronger and commonly preferred once your sender setup is clean. If you have legacy constraints, start with monitoring and test carefully.
Do DMARC reports replace inbox testing?
No. Reports are essential, but you should still perform real send/receive tests across your critical business workflows.
DMARC examples are useful only when combined with proper sender inventory and staged rollout discipline.
Use these patterns as your starting framework, then validate every sender before enforcement. If you want help doing this safely, book a DMARC review with us.