This is the DMARC setup Microsoft 365 should have included from day one but didn't. Not misconfigured. Missing entirely. SPF gets partial coverage out of the box, DKIM signing is off by default, and DMARC doesn't exist for your domain until you publish it yourself. We audited 435 Southwest Michigan business domains for our Southwest Michigan Email Security Report. Nearly 86 percent had no DMARC enforcement at all. If your Battle Creek or Kalamazoo business runs on M365, here's the setup Microsoft never mentioned.
Does Microsoft 365 automatically set up DMARC for your domain?
No. Microsoft configures a baseline SPF record for its own mail servers. That record doesn't know about your invoicing tool, your CRM, or any other service sending email as your domain. DKIM signing exists in M365 but is off by default for custom domains. DMARC has no default at all. Until you publish a DMARC record in your DNS, nothing tells Gmail, Yahoo, or anyone else what to do with a message that fails authentication.
Why does it matter that M365 doesn't configure DMARC by default?
The gap sits open the whole time you own the domain. Someone eventually finds it. Business email compromise cost companies just over $3 billion in 2025, according to the FBI Internet Crime Complaint Center's 2025 Annual Report, the second-costliest cybercrime category the FBI tracks.
Microsoft has started enforcing its own rules too. Since May 2025, Microsoft rejects bulk mail from senders without SPF, DKIM, and DMARC sending 5,000 or more messages a day to Outlook, Hotmail, or Live addresses. Most small businesses don't hit that volume. But the direction is clear. Authentication is moving from best practice to requirement.
Step 1: Does your domain already have SPF configured?
Check before you assume. Run your domain through MXToolbox's SuperTool and look up your SPF record. A working M365 SPF record includes include:spf.protection.outlook.com, plus anything else that sends mail as your domain.
Most small businesses in Southwest Michigan run more mail senders than they realize. A landscaping company might send quotes through Jobber, invoices through QuickBooks, and marketing emails through Mailchimp. All under the same domain. All needing their own line in the SPF record. Miss one and that tool's emails start failing authentication even though nothing is wrong. Pull up the record now and check it against every service that emails on your behalf.
Step 2: How do you enable DKIM signing for your custom domain in M365?
Turn it on inside the Microsoft 365 Defender portal. Go to Email & collaboration, then Policies & rules, then Threat policies, then Email authentication settings, then DKIM. Select your domain and flip DKIM signing to Enabled. Microsoft generates the signing keys. You just need to publish the two CNAME records it gives you in your domain's DNS, then confirm the status shows Enabled.
This step trips people up. The two CNAME records look meaningless out of context. Just long strings of characters pointing to a Microsoft domain. Copy them exactly as shown, including the selector prefixes. A typo in a CNAME record doesn't throw an error. It quietly fails to sign your mail, and you won't know until a message gets flagged or bounced somewhere down the line.
Step 3: How do you publish a DMARC record for your M365 domain?
Add one TXT record at _dmarc.yourdomain.com in your DNS panel. Start with a monitor-only policy: v=DMARC1; p=none; rua=mailto:[email protected]. Failures get reported to your inbox without blocking anything yet. Most domain registrars (GoDaddy, Bluehost, Namecheap) let you add this from the same DNS page where you manage SPF and DKIM. Order matters: SPF and DKIM should both be working before you publish DMARC, since DMARC only evaluates the results those two checks already produced.
Use an inbox you actually check for the rua reporting address. Some setups route reports to a shared inbox nobody reads. That defeats the point. If you run a small crew and check email from your phone between jobs, a dedicated folder or filter rule for DMARC reports works better than trusting yourself to remember a separate inbox exists.
What mistakes do small businesses make setting up DMARC on M365?
The most common one is jumping straight to p=reject without watching reports first. That blocks failures immediately, including legitimate mail from a service you forgot was sending on your behalf. The fix is patience. Stay at p=none for at least a couple of weeks. Read what comes in. Fix any gaps in your SPF record. Then move to p=quarantine before ever touching p=reject.
The second most common mistake is forgetting third-party senders entirely. A DMARC rollout usually starts with the obvious accounts (Outlook, the shared team inbox) and misses the CRM, the appointment reminder tool, or the review-request service that also sends mail as your domain. Those get caught in the DMARC reports once monitoring starts. That's exactly why the monitor-only period matters.
What should you do after publishing your DMARC record?
Wait, watch, then tighten. Give it 24 to 48 hours to propagate, then verify the record is live with MXToolbox's SuperTool (the same lookup from step one). Read the DMARC reports that start arriving. They tell you which services send mail as your domain and whether they're passing SPF and DKIM. Once you've watched a few weeks of clean reports, move from p=none to p=quarantine, then eventually to p=reject. Most businesses take six to eight weeks to reach full enforcement safely.
What does ongoing DMARC monitoring mean for a small business?
It means someone is reading those reports so you don't have to. DMARC reports arrive as raw XML files, not a dashboard. Most small business owners in Southwest Michigan have neither the time nor the reason to learn how to parse them. Parallax's DMARC audit checks your current SPF, DKIM, and DMARC setup, tells you exactly what's missing, and handles the DNS changes and the ongoing report review. Call (269) 460-1772 to start with a free domain check, or read what SPF, DKIM, and DMARC actually do first if you want the plain-language version before diving into setup.
Frequently asked questions
Does Microsoft 365 do DMARC automatically?
No. Microsoft configures a partial SPF baseline, but DKIM and DMARC both require manual setup for your custom domain.
What happens if I set the DMARC policy to reject too quickly?
Legitimate email (invoices, quotes, replies from services you forgot were sending on your behalf) can get rejected or sent to spam along with the fake messages. Start at p=none and watch reports before moving to p=quarantine or p=reject.
Is DMARC required for a small business?
Microsoft and Google both require SPF, DKIM, and DMARC for high-volume senders (5,000 or more emails a day). Most small businesses don't hit that threshold, but the direction is clear: authentication is becoming table stakes, and an unenforced domain is one anyone can impersonate.
If your quotes are landing in spam right now, why emails aren't reaching customers covers the symptoms before you get to setup. If you'd rather have a Southwest Michigan team handle the DNS changes directly, Parallax's DMARC audit is a free place to start.