Setup Guides · Microsoft 365
Microsoft 365 SPF Setup: One Record, the Right Include, and the 10-Lookup Trap
SPF for Microsoft 365 is a single DNS record - v=spf1 include:spf.protection.outlook.com -all - but the details are where it breaks: a second SPF record, the ten-DNS-lookup limit, and the moment you forget a third-party sender. This guide is the exact record, how to add other senders safely, when to switch to -all, and the five failures we keep finding.
Last updated 30 August 2026 · applies to all Microsoft 365 / Exchange Online tenants
What SPF does (and does not) do
SPF publishes the list of servers allowed to send mail for your domain. A receiver checks the sending server against that list and records a pass or fail. It is one of the two authentication checks DMARC relies on - but SPF alone has two limits worth knowing before you start: it authenticates the envelope (Return-Path) domain, not your visible From, and it breaks whenever mail is forwarded. That is why SPF is necessary but not sufficient: real protection needs SPF, DKIM, and DMARC together.
What you need
- Access to your domain's public DNS (registrar or DNS host).
- A list of every service that sends mail as your domain - Microsoft 365 plus any marketing, invoicing, CRM or help-desk tools.
- About 10 minutes, plus DNS propagation time.
The setup, step by step
1 Check whether you already have an SPF record
Look up your domain's TXT records for one starting with v=spf1. Microsoft 365 onboarding often adds one automatically. You are editing that single record - never creating a second one. The fast way: run your domain through the SPF checker, which shows the current record and counts its DNS lookups.
2 Publish the Microsoft 365 record
Set a single TXT record at your domain root (@):
Name: @ (your domain root) Type: TXT Value: v=spf1 include:spf.protection.outlook.com -all
The include:spf.protection.outlook.com is the only mechanism Microsoft 365 needs - it expands to Microsoft's full outbound range. While you are still confirming senders you can end with ~all (soft fail) instead of -all.
3 Add any other senders - before the all
Every additional service that sends as your domain needs its own mechanism, placed before the all:
v=spf1 include:spf.protection.outlook.com include:_spf.example-marketing.com -all
Add the exact include each vendor documents. Do not add servers you do not recognise, and do not use +all (which authorises the whole internet).
4 Stay under the 10-lookup limit
SPF permits at most ten DNS lookups when a record is evaluated. include:spf.protection.outlook.com now costs exactly one lookup - Microsoft flattened it into a single ip4/ip6 list, so it no longer nests further includes (most guides on the internet still say three; resolve it yourself and you will see one). That gives you more headroom than the old advice implies, but the limit still bites: stack several third-party includes and you can quietly cross ten - a permerror that fails SPF for all your mail, Microsoft's included. If the checker shows you near the limit, consolidate vendors or use an SPF-flattening service. Note that DKIM alignment does not count against this limit, which is another reason to lean on DKIM.
5 Switch to -all and verify
Once the reports and checker confirm every legitimate sender is listed, change ~all to -all for a hard fail. Then send one email to Postbox Mailtester - it confirms SPF passes, aligns, and stays under the lookup limit.
The five failures we keep finding
1. Two SPF records
A domain may have only one v=spf1 record. A second one (often left behind by an old provider) is a permerror and SPF fails for everyone. Merge every sender into a single record.
2. More than ten DNS lookups
The most common silent failure. Adding include after include eventually exceeds ten lookups and permerrors - Microsoft's own mail fails SPF even though the include is correct. Count with the checker and consolidate.
3. A forgotten third-party sender
Marketing, invoicing or ticketing tools that send as your domain but are not in the record fail SPF - and once you enforce DMARC, get quarantined. List every sender before you tighten all.
4. Leaving it on ~all (or using +all)
~all is a safe temporary setting, not a destination - it tells receivers "probably not us, but deliver anyway". +all is worse: it authorises the entire internet. Finish at -all.
5. Trusting SPF to survive forwarding
SPF breaks whenever a message is forwarded, so an SPF-only domain fails DMARC on any forwarded mail. This is why you also need aligned DKIM and a monitored DMARC policy - SPF is one leg of three.
Verify it end to end
- Check the record + lookups: the SPF checker validates syntax, counts DNS lookups, and flags a second record or a permerror.
- Confirm on a real message: send one email to Postbox Mailtester - it reports SPF, alignment, and the rest of your authentication in one score.
Frequently asked questions
What is the SPF record for Microsoft 365?
v=spf1 include:spf.protection.outlook.com -all, published as one TXT record at your domain root. Add any other sender's include before the -all.
Can I have more than one SPF record?
No. One v=spf1 record per domain - two is a permerror. Merge every service into a single record.
What is the 10-lookup limit?
SPF allows at most ten DNS lookups to evaluate a record. The Outlook include now costs just one lookup (Microsoft flattened it - many guides still say three), but stacking several other includes can still exceed ten, which permerrors and fails SPF for all your mail. Consolidate to stay under it.
-all or ~all?
Use -all (hard fail) once every legitimate sender is listed. ~all is a safe temporary setting while you confirm; do not leave it there forever.
Related: Microsoft 365 DKIM · Microsoft 365 DMARC · Google Workspace SPF. The SPF standard is RFC 7208.
Not sure your SPF is under the limit?