How to Set Up SPF Record for Microsoft 365 (Office 365)

Microsoft 365 (formerly Office 365) accounts send email through Microsoft's servers. Without an SPF record authorizing Microsoft's servers for your domain, receiving mail servers cannot verify that your Microsoft 365 emails are legitimate - leading to spam placement or outright rejection. Here's the exact SPF record to use and where to add it.

The SPF Record for Microsoft 365

Add this TXT record to your domain's DNS:

• Type: TXT
• Host / Name: @ (your root domain)
• Value: v=spf1 include:spf.protection.outlook.com ~all
• TTL: 3600 (1 hour)

If you also send from other services (Google Workspace, SendGrid, HubSpot, etc.), combine their includes in a single record: v=spf1 include:spf.protection.outlook.com include:_spf.google.com ~all. You can only have one SPF TXT record per domain.

Where to Add the SPF Record by Registrar

GoDaddy

Domains → Manage DNS → scroll to TXT Records → Add. Type: TXT, Name: @, Value: the SPF string above, TTL: 1 Hour. Click Save.

Namecheap

Domain List → Manage → Advanced DNS → Add New Record. Type: TXT Record, Host: @, Value: the SPF string, TTL: Automatic. Click the green checkmark.

Cloudflare

DNS → Add Record. Type: TXT, Name: @ (or your domain), Content: the SPF string. Set proxy to "DNS only" (grey cloud). Save.

AWS Route 53

Hosted Zones → your domain → Create Record. Type: TXT, Record name: leave blank for root, Value: wrap the SPF string in double quotes. Create records.

Common Mistakes

• Duplicate SPF records: If a TXT record with v=spf1 already exists, edit it - do not add a second one. Two SPF records break SPF validation entirely.
• Wrong include: The correct include for Microsoft 365 is include:spf.protection.outlook.com. Some older guides list include:outlook.com - this is incorrect and will fail verification.
• Exceeding 10 DNS lookups: SPF is limited to 10 DNS lookups per evaluation. If you have many ESPs, use an SPF flattening tool to reduce lookup depth.
• Wrong host field: Use @ for the root domain. Using www or leaving it blank creates the record in the wrong place.

How to Verify

• Wait 15–60 minutes for DNS propagation after adding the record
• Use MXToolbox SPF Lookup: enter your domain and confirm it shows include:spf.protection.outlook.com as authorized
• Send a test email to a Gmail address and check the headers: look for spf=pass in the Authentication-Results header
• In the Microsoft 365 Admin Center: Settings → Domains → your domain → DNS records - Microsoft will show a warning if SPF is not detected

After SPF passes, set up DKIM (Microsoft 365 Admin Center → Security → Email Authentication → DKIM → enable and publish CNAME records), then DMARC. All three together are required for Microsoft 365 inbox placement reliability in 2025.