SPF for Microsoft 365: Complete Setup Guide for Office 365 Email

Microsoft 365 (formerly Office 365) is one of the most widely used business email platforms. If you send email through Microsoft 365, you need an SPF record that authorizes Microsoft's servers to send on behalf of your domain. Without it, your emails may land in spam or get rejected.

For a comprehensive overview of SPF, see our complete SPF guide. This guide walks you through the setup step by step — no technical background required.

The Microsoft 365 SPF Include

To authorize Microsoft 365 to send email for your domain, you need this include statement in your SPF record (Microsoft 365 documentation):

include:spf.protection.outlook.com

This single include covers Exchange Online and all of Microsoft 365's email infrastructure. Microsoft maintains this record and updates it when their server IPs change, so you don't have to.

Setting Up SPF for Microsoft 365

If your domain doesn't have an SPF record yet, follow these steps to create one.

Adding Microsoft 365 to an Existing SPF Record

If you already have an SPF record — maybe for another email service — you need to add Microsoft's include to it. Never create a second SPF record.

Before (Google Workspace only):

v=spf1 include:_spf.google.com ~all

After (Google Workspace + Microsoft 365):

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

Simply add include:spf.protection.outlook.com before the ~all at the end. The order of include statements doesn't matter.

Common Microsoft 365 SPF Mistakes

Using the wrong include domain

This is the most common error. Here are incorrect values people frequently use:

The only correct value is: include:spf.protection.outlook.com

Confusing Exchange Online with Exchange on-premises

If your organization uses an on-premises Exchange server (not Microsoft 365), the SPF configuration is different. On-premises Exchange sends from your own servers with your own IP addresses, so you would use ip4: entries pointing to your mail server IPs instead of the Microsoft 365 include.

If you're in a hybrid setup (some mailboxes on-premises, some in Microsoft 365), you need both: the Microsoft 365 include for cloud mailboxes and ip4: entries for your on-premises servers.

v=spf1 ip4:203.0.113.25 include:spf.protection.outlook.com ~all

Creating duplicate SPF records

This happens especially during migrations. If you're moving to Microsoft 365 from another provider, edit your existing SPF record — don't create a new one alongside it.

Wrong (two SPF records):

v=spf1 include:_spf.google.com ~all
v=spf1 include:spf.protection.outlook.com ~all

Right (single combined record):

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

Forgetting to remove old providers

After migrating to Microsoft 365, remove the SPF include for your previous email provider once the migration is complete and you've confirmed no email is still routing through the old service. Keeping unnecessary includes wastes DNS lookups.

Verifying Your Microsoft 365 SPF Setup

After making changes, verify everything is working correctly.

Check via the Admin Center

In the Microsoft 365 Admin Center, go to Settings > Domains. Select your domain and look at the DNS records section. Microsoft will flag any issues with your SPF configuration.

Send a test email

Send an email from your Microsoft 365 account to a personal Gmail address. In Gmail, open the email, click the three dots, and select "Show original." Look for the SPF result:

spf=pass (google.com: domain of [email protected] designates [IP] as permitted sender)

If you see spf=pass, your SPF record is working correctly.

Check DMARC reports

If you have DMARC configured with reporting, your aggregate reports will show SPF pass/fail rates over time. This is the best way to monitor ongoing authentication health.

Complete Email Authentication for Microsoft 365

SPF is only one part of email authentication. Microsoft 365 supports all three major protocols:

DKIM — Microsoft 365 supports DKIM signing. In the Microsoft 365 Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings to configure DKIM for your domain. Verify your setup with a DKIM checker.

DMARC — After SPF and DKIM are configured, publish a DMARC record to tell receiving servers how to handle authentication failures. Start with a monitoring policy (p=none) and work toward enforcement. Check your DMARC with a DMARC record checker.

Microsoft 365 with Other Email Services

Most businesses use additional email services beyond Microsoft 365. Each service needs its own include in your SPF record. See our guide on SPF for multiple ESPs for best practices on combining providers.

Example with Microsoft 365 + SendGrid + Mailchimp:

v=spf1 include:spf.protection.outlook.com include:sendgrid.net include:spf.mandrillapp.com ~all

Keep an eye on your total DNS lookup count. Microsoft 365's include uses approximately 2-3 lookups. With multiple services, you can approach the 10 DNS lookup limit quickly.

If you need help constructing your record, SPF Creator can generate the correct syntax based on your email services.

Monitor Your SPF Records

Email infrastructure changes over time — providers update their servers, team members modify DNS records, and domain migrations can overwrite settings. Continuous monitoring catches these problems before they impact deliverability.

References

• RFC 7208: Sender Policy Framework (SPF) — The current SPF specification
• Microsoft 365: Set up SPF to help prevent spoofing — Official Microsoft 365 SPF configuration guide