How to Set Up SPF for Microsoft 365

Add the correct SPF record to authorize Microsoft 365 (Exchange Online) to send email on behalf of your domain.

Quick Answer — The Record You Need

Record Type

TXT

Host / Name

Value

v=spf1 include:spf.protection.outlook.com ~all

This is the standard include for all Microsoft 365 / Exchange Online tenants.

Step-by-Step Setup

Sign in to your DNS provider

Log in to the DNS management portal for your domain (e.g., GoDaddy, Cloudflare, Namecheap, or Microsoft if they manage your DNS).

Check for an existing SPF record

Look for a TXT record starting with v=spf1. You must have only one SPF record per domain.

dig TXT yourdomain.com +short | grep spf

Create or update the SPF TXT record

Add a new TXT record (or modify the existing one) with host @ and the value below.

v=spf1 include:spf.protection.outlook.com ~all

Wait for DNS propagation

DNS changes can take up to 48 hours to propagate, though most providers update within minutes.

Verify in Microsoft 365 Admin Center

Go to the Microsoft 365 Admin Center > Settings > Domains > select your domain > DNS records. Microsoft will check your SPF record and show a green checkmark when valid.

Before & After

Before

v=spf1 ~all

After

v=spf1 include:spf.protection.outlook.com ~all

Common Gotchas

The correct include is spf.protection.outlook.com, not outlook.com or microsoft.com. Using the wrong value will not authorize Microsoft 365 mail servers.
If you also use on-premises Exchange in a hybrid deployment, you may need to add your on-premises server IPs to the SPF record as well.
Microsoft 365 automatically adds the include during domain setup if Microsoft manages your DNS, but you need to add it manually for third-party DNS providers.

Verify Your Setup

After adding your DNS records, use our free SPF checker to verify everything is configured correctly. DNS changes typically propagate within minutes, but can take up to 48 hours.

Frequently Asked Questions

What SPF record do I need for Microsoft 365?

You need a TXT record at @ with the value v=spf1 include:spf.protection.outlook.com ~all. This authorizes Exchange Online servers to send email for your domain.

Do I need different SPF records for Exchange Online and on-premises Exchange?

If you run a hybrid Exchange deployment, you need both the Microsoft 365 include and your on-premises server IPs: v=spf1 include:spf.protection.outlook.com ip4:YOUR.SERVER.IP ~all.

I see spf.protection.outlook.com and protection.outlook.com. Which is correct?

Use include:spf.protection.outlook.com for SPF records. The hostname protection.outlook.com (without the spf. prefix) is used for MX records, not SPF.