Email authentication for Microsoft 365
Practical, step-by-step guides to setting up SPF, DKIM and DMARC in Microsoft 365, written for IT admins and the teams that support them.
How to set up DMARC for Microsoft 365
A safe path from no DMARC record to p=reject: SPF, DKIM, your first DMARC record, reading reports, and enforcement.
Read the guideHow to enable DKIM in Microsoft 365
Find your CNAME records in the Defender portal, publish them, turn on signing, and verify it works. Includes PowerShell and key rotation.
Read the guideWhy third-party email fails DMARC in Microsoft 365
Why newsletter tools, CRMs and helpdesks fail DMARC even when SPF and DKIM pass, and how to fix each one before you enforce.
Read the guideWhy Microsoft 365 needs extra attention
Microsoft 365 handles SPF for its own servers and signs email from your onmicrosoft.com domain, but it doesn't publish DMARC for your custom domains or sign their email with your own domain until you set it up. Most organizations also send email through other services, such as newsletter tools, CRMs and helpdesks, that need their own configuration. These guides walk through each step in the order that keeps your legitimate email flowing while you move to full protection.
Let us watch your domains for you
MailIntel watches your DMARC reports continuously and alerts you when something needs attention.