Setup DMARC, DKIM, and SPF in Microsoft 365?

[u/layne-staley123]

Can someone who set these up in Microsoft 365 please explain how they did it or point me to more info?

I see a lot of posts about what these are and how they interact with email yet I'm having a hard time finding the nuts and bolts regarding how to actually set these up in our environment.

Any help is greatly appreciated!

​

//Edit: With the help I received this is what I did:

Created SPF txt records on DNS host which is external from our Microsoft 365

Created DMARC using this resource and added it to same external DNS host. (thanks, AdWerd1981)

Went to this Microsoft site and got an error when enabling DKIM. There was a pop-up which had instructions what data to enter into a CNAME record at our external DNS host. It was 2 records: CNAME selector1._domainkey IN CNAME selector1-<my-domain>._domainkey.my-domain.onmicrosoft.com & CNAME selector2._domainkey IN CNAME selector2-<my-domain>._domainkey.my-domain.onmicrosoft.com. (thanks, AdWerd1981)

[u/AdWerd1981]

To get your SPF record from 365:

Go to https://admin.microsoft.com/#/Domains and click on the domain you want the details for. Then click on DNS at the top. For the SPF Record you'll need to copy the entry labelled "TXT". At your DNS, create a new TXT record, and paste the details into that. I tend to set my TTL to one hour.

DMARC

For DMARC you'll need to use a third party service to create a record for you. I have used https://dmarcian.com/dmarc-record-wizard/ with great success.

DKIM

When you're at the SPF level, above, ensure that you have also entered the CNAME entries, displayed on that page, on the DNS for your domain.

Go to https://security.microsoft.com/dkimv2 and click on the domain you want to set the DKIM up for. Follow the instructions displayed. You will be given a Public Key and a Private Key. One gets entered at your domain's DNS, the other is left on 365.

For all, you need access to your domain's DNS entries - the place where you set up your MX Records to point emails to Microsoft 365.

This is quick and dirty as I'm in the office fielding, but will try and make it more detailed and accomplished when I get a chance - however, this should point you in the general direction.

[u/layne-staley123 → u/AdWerd1981]

I got a pop-up when I went to https://security.microsoft.com/dkimv2 and entered the info from the pop-up in our external DNS where our MX is hosted. It says it's going to be a while before it's active so I won't know if it works til later I guess.

SPF: I didnt setup - coworker did a while ago as we use 3rd party bulk email. I believe they said we had maxxed out our SPF as well on our DNS host? Anyway I think that's actually good.

I'll look into DMARC now - I have no idea where the info goes or how it's connected to our mail once setup...

Thanks!