This is the DMARC setup Microsoft 365 (still called Office 365 by plenty of people) should have included from day one but didn't. Not misconfigured. Missing entirely. SPF is yours to publish, DKIM signing is off by default, and DMARC doesn't exist for your domain until you publish it yourself. I checked 1,527 Southwest Michigan businesses for my Southwest Michigan Email Security Report. Of the 847 that email from their own domain, 79.2 percent had no DMARC enforcement at all. If your Battle Creek or Kalamazoo business runs on M365, here's the setup Microsoft never mentioned.
Not sure where your domain stands? The free email security check reads your public DMARC and SPF records in seconds, before you change anything.
Does Microsoft 365 automatically set up DMARC for your domain?
No. Microsoft tells you the SPF value to publish (include:spf.protection.outlook.com), but for a custom domain you add it at your DNS host yourself unless Microsoft manages your DNS. That value alone doesn't know about your invoicing tool, your CRM, or any other service sending email as your domain. DKIM signing exists in M365 but is off by default for custom domains. DMARC has no default at all. Until you publish a DMARC record in your DNS, nothing tells Gmail, Yahoo, or anyone else what to do with a message that fails authentication.
Is Office 365 the same as Microsoft 365 for DMARC setup?
Yes. It's the same product with a newer name. Microsoft renamed its Office 365 business plans to Microsoft 365 on April 21, 2020, according to Microsoft's March 2020 plan-naming announcement. Office 365 Business Premium became Microsoft 365 Business Standard. Office 365 Business Essentials became Business Basic. Nothing about email changed.
Plenty of Battle Creek and Kalamazoo owners still say Office 365. That's fine. Microsoft does too, sometimes. Its DKIM setup guide still lives in the Defender for Office 365 section of its docs. Every step below works the same whichever name is on your invoice.
Why does it matter that M365 doesn't configure DMARC by default?
The gap sits open the whole time you own the domain. Someone eventually finds it. Business email compromise cost companies just over $3 billion in 2025, according to the FBI Internet Crime Complaint Center's 2025 Annual Report, the second-costliest cybercrime category the FBI tracks.
Microsoft has started enforcing its own rules too. Since May 2025, Microsoft has required SPF, DKIM, and DMARC from domains that send 5,000 or more messages a day to Outlook, Hotmail, or Live addresses. Mail that fails gets rejected with a 550 5.7.515 bounce. Most small businesses don't send that much. The rule still shows where the big inbox providers are headed. Gmail is stricter at the low end. Its SPF-or-DKIM rule covers every sender, and mail that fails can bounce with a 550 5.7.26 error.
Step 1: Does your domain already have SPF configured?
Check before you assume. Run your domain through MXToolbox's SuperTool and look up your SPF record. A working M365 SPF record includes include:spf.protection.outlook.com, plus anything else that sends mail as your domain.
Most small businesses in Southwest Michigan run more mail senders than they realize. A landscaping company might send quotes through Jobber, invoices through QuickBooks, and marketing emails through Mailchimp. All under the same domain. All needing their own line in the SPF record. Miss one and that tool's emails start failing authentication even though nothing is wrong. Pull up the record now and check it against every service that emails on your behalf.
Step 2: How do you enable DKIM signing for your custom domain in M365?
Turn it on inside the Microsoft Defender portal at security.microsoft.com. Go to Email & collaboration, then Policies & rules, then Threat policies, then Email authentication settings, then DKIM. Select your domain and flip DKIM signing to Enabled. Microsoft generates the signing keys. You just need to publish the two CNAME records it gives you in your domain's DNS, then confirm the status shows Enabled. Don't panic if it isn't instant. DNS propagation can take anywhere from a few minutes to 48 hours, according to Microsoft's DKIM setup guide on Microsoft Learn.
This step trips people up. The two CNAME records look meaningless out of context. Just long strings of characters pointing to a Microsoft domain. Copy them exactly as shown, including the selector prefixes. A typo in a CNAME record doesn't throw an error. It quietly fails to sign your mail, and you won't know until a message gets flagged or bounced somewhere down the line.
Step 3: How do you publish a DMARC record for your Office 365 domain?
Add one TXT record at _dmarc.yourdomain.com in your DNS panel. Start with a monitor-only policy: v=DMARC1; p=none; rua=mailto:[email protected]. Failures get reported to your inbox without blocking anything yet. Most domain registrars (GoDaddy, Bluehost, Namecheap) let you add this from the same DNS page where you manage SPF and DKIM. Order matters: SPF and DKIM should both be working before you publish DMARC, since DMARC only evaluates the results those two checks already produced.
Use an inbox you actually check for the rua reporting address. Some setups route reports to a shared inbox nobody reads. That defeats the point. If you run a small crew and check email from your phone between jobs, a dedicated folder or filter rule for DMARC reports works better than trusting yourself to remember a separate inbox exists.
What mistakes do small businesses make setting up DMARC on M365?
The most common one is jumping straight to p=reject without watching reports first. That blocks failures immediately, including legitimate mail from a service you forgot was sending on your behalf. Outlook and Microsoft 365 recipients bounce that mail with a 550 5.7.509 error. The fix is patience. Stay at p=none for at least a couple of weeks. Read what comes in. Fix any gaps in your SPF record. Then move to p=quarantine before ever touching p=reject.
The second most common mistake is forgetting third-party senders entirely. A DMARC rollout usually starts with the obvious accounts (Outlook, the shared team inbox) and misses the CRM, the appointment reminder tool, or the review-request service that also sends mail as your domain. Those get caught in the DMARC reports once monitoring starts. That's exactly why the monitor-only period matters.
What should you do after publishing your DMARC record?
Wait, watch, then tighten. Give it 24 to 48 hours to propagate, then verify the record is live with MXToolbox's SuperTool (the same lookup from step one). Read the DMARC reports that start arriving. They tell you which services send mail as your domain and whether they're passing SPF and DKIM. Once you've watched a few weeks of clean reports, move from p=none to p=quarantine, then eventually to p=reject. Plan on a few weeks of watching reports before you reach full enforcement.
What does ongoing DMARC monitoring mean for a small business?
It means someone is reading those reports so you don't have to. DMARC reports arrive as raw XML files, not a dashboard. Most small business owners in Southwest Michigan have neither the time nor the reason to learn how to parse them. My DMARC audit checks your current SPF, DKIM, and DMARC setup, tells you exactly what's missing, and handles the DNS changes and the ongoing report review. Call (269) 460-1772 to start with a free domain check.
Not on Microsoft 365, or want the plain-language version first? My step-by-step DMARC setup for any small business covers it in six steps that work with any email provider. If you'd rather I handle the DNS changes for you, the free check on the audit page is the place to start.
Frequently asked questions
Does Microsoft 365 do DMARC automatically?
No. Microsoft gives you the SPF value to publish, but for a custom domain you add it at your DNS host yourself unless Microsoft manages your DNS. DKIM and DMARC both need manual setup too.
What happens if I set the DMARC policy to reject too quickly?
Legitimate email from services you forgot were sending on your behalf can get rejected or sent to spam. Start at p=none and watch reports before moving to p=quarantine or p=reject.
Is DMARC required for a small business?
Microsoft and Google both require SPF, DKIM, and DMARC for high-volume senders. Most small businesses do not hit that threshold yet, but authentication is becoming table stakes and an unenforced domain is one anyone can impersonate.
Is DMARC setup different for Office 365 and Microsoft 365?
No. Microsoft renamed its Office 365 business plans to Microsoft 365 in April 2020. The SPF, DKIM, and DMARC records are the same, and so is the admin portal.
Is DKIM enabled by default in Office 365?
No. Office 365 and Microsoft 365 only sign mail from the built-in onmicrosoft.com domain. For your own domain, you turn on DKIM signing in the Microsoft Defender portal and publish two CNAME records.