Microsoft 365 email authentication
Microsoft’s hosted Exchange Online, bundled with Office 365 business plans.
SPF record
Add Microsoft 365 to your domain's SPF record with this include:
include:spf.protection.outlook.com
A complete record for a domain sending only through Microsoft 365:
v=spf1 include:spf.protection.outlook.com ~all
What it costs you
1 of your 10 DNS lookups. That is the cheapest an include can be — the record it points at contains only IP ranges, with no further includes to follow. Behind it are 11 IP ranges.
Live record
This is what spf.protection.outlook.com published when this page was generated:
v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all
Domains using Microsoft 365
Found while resolving 293 well-known domains on 2026-08-04 — each authorises
spf.protection.outlook.com in its published SPF record:
DKIM
Enable DKIM inside Microsoft 365 and publish the selector record it generates. DKIM matters more than SPF for deliverability, because a DKIM signature survives forwarding while SPF does not — see how selectors work.
DMARC
Neither SPF nor DKIM protects the address your recipients actually see until DMARC ties them
to it. Once Microsoft 365 is authenticating, publish a DMARC record — start at
p=none with a reporting address and
tighten from there.
Check it worked
DNS changes take minutes to hours to propagate. Once published, run the domain through the checker — it resolves the full include chain and reports the real lookup count.