DMARC, DKIM and SPF on Microsoft 365 for UK SMEs

SPF, DKIM and DMARC decide whether other mail systems trust email that claims to come from your domain. For a UK SME on Microsoft 365, getting them right protects customers from invoices that look like yours and keeps your own mail out of junk folders.

Two things have changed the picture. Microsoft now enforces authentication rules for high-volume senders to Outlook.com, and the NCSC retired its free Mail Check service on 31 March 2026. Many small firms relied on Mail Check reports without noticing.

The goal Microsoft sets out is simple: reach p=reject for every domain you own, without blocking your own legitimate mail on the way.

Quick answer

1. List every service that sends email as your domain, not just Exchange Online.
2. Publish one SPF record per sending domain and keep it within DNS lookup limits.
3. Turn on DKIM signing for each custom domain in the Microsoft Defender portal.
4. Publish DMARC at p=none with aggregate reporting to a shared mailbox or reporting service.
5. Fix alignment for each sender, then move to p=quarantine and finally p=reject.
6. Publish v=DMARC1; p=reject; on parked domains and your unused onmicrosoft.com domain.

Start with an inventory of senders

The DNS records are the easy part. The hard part is knowing who sends as you. Typical SME senders include Exchange Online, an accounting package that emails invoices, a CRM or newsletter tool, a website contact form and sometimes a scanner or line-of-business app.

Microsoft recommends using a subdomain, such as marketing.example.co.uk, for bulk services you do not directly control. A problem with that service then does not damage the reputation of your main domain.

Write each sender down with an owner and a note of whether it can sign with DKIM using your domain. That list becomes your DMARC plan.

SPF and DKIM on Microsoft 365

SPF lists the servers allowed to send for a domain. On Microsoft 365, the record includes spf.protection.outlook.com plus any other genuine senders. Keep a single SPF record per domain.

DKIM signs each message so the receiver can verify it was not altered. In Microsoft 365 you publish two CNAME records and enable signing for each custom domain in the Defender portal. Without it, messages are signed with the onmicrosoft.com domain, which does not align with your From address.

Alignment matters because DMARC passes only when SPF or DKIM passes for a domain that matches the From address. Microsoft's own troubleshooting guidance gives the common failure: a third-party service passes SPF for its own bounce domain and signs with its own DKIM key, so DMARC still fails for your domain. The fix is to configure custom DKIM at that service, or change its MAIL FROM to your domain.

Outlook's rules for high-volume senders

On 2 April 2025, Microsoft announced new requirements for domains sending more than 5,000 emails a day to Outlook consumer addresses. Those domains must pass SPF and DKIM and publish DMARC of at least p=none, aligned with SPF or DKIM, preferably both.

The original plan was to route non-compliant mail to Junk first. Microsoft updated the post on 29 April 2025: instead, non-compliant messages are rejected with the error 550; 5.7.515 Access denied, taking effect from 5 May 2025.

Most SMEs do not send 5,000 messages a day. Your newsletter platform might, though, and Microsoft states that all senders benefit from the same practices. If you see 5.7.515 bounces, start with your bulk mail provider.

Replacing NCSC Mail Check

The NCSC retired Mail Check and Web Check on 31 March 2026. From that date, users no longer receive findings from either service. The NCSC's advice is to use a commercial external attack surface management product instead.

For a small firm that can be a DMARC reporting service. Microsoft suggests searching the Microsoft Intelligent Security Association catalogue for DMARC reporting vendors. Whatever you choose, it must turn daily XML aggregate reports into a list of senders and pass or fail results.

The NCSC also offers an email security check tool that tests whether a domain is configured in line with its guidance. It is useful for a quick look, but it does not replace ongoing report monitoring.

Moving from p=none to reject

Microsoft's rollout guidance on Learn is gradual:

1. Monitor at p=none. Publish v=DMARC1; p=none; pct=100; rua=mailto:.... Review reports weekly during rollout. Microsoft notes receivers typically cover 70 to 90 per cent of mail volume in reports.
2. Move to quarantine. When all known senders align, set p=quarantine. You can step through pct= values such as 10, 25, 50, 75 and 100.
3. Move to reject. After a quiet period at quarantine, set p=reject.
4. Work outwards. Start with low-volume subdomains and do the parent domain last.

Two Microsoft 365 details are worth knowing. Outbound mail that fails DMARC at the destination is routed through the high-risk delivery pool when your policy is quarantine or reject. And Microsoft 365 does not send forensic reports, so rely on aggregate reports and message trace.

Keep the change record. The Microsoft 365 security review first 10 checks covers where email authentication fits in a wider baseline, and Defender for Office 365 Standard vs Strict covers the inbound side, including honouring other senders' DMARC policies.

Source basis

• Set up DMARC to validate email in Microsoft 365, Microsoft Learn
• Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders, Microsoft Tech Community
• NCSC to retire Web Check and Mail Check, NCSC
• Email security and anti-spoofing, NCSC