Create SPF, DKIM and DMARC records

Always check the include in the service's documentation; it can change. Many newsletter and transactional services (SES, SendGrid, Mailgun, Postmark) use their own domain or a subdomain of yours as the envelope sender. Their include then belongs there, not on your main domain, and DKIM takes care of DMARC alignment.

With Microsoft 365 you usually don't need these: mx then points to Microsoft, which the include already covers. Each one costs a DNS lookup.

IP addresses cost no DNS lookup; every include does, plus everything inside that include.

With DMARC it makes little difference to the receiver whether you pick -all or ~all: DMARC decides. Without DMARC, -all is the clearest choice. We deliberately don't offer +all (anyone may send).

Microsoft holds the keys and rotates them with Rotate-DkimSigningConfig. Since 2025 new CNAME records point to an address ending in dkim.mail.microsoft, with a part that differs per tenant. So always copy the values from Get-DkimSigningConfig or the Defender portal.

In the Azure portal: Email Communication Service → Provision domains → Add domain → Custom domain. Azure shows the TXT code to confirm the domain there, then SPF and the two DKIM records. Sending from a subdomain (for example mail.contoso.nl)? Enter that subdomain as the domain above; the records then go on the subdomain.

A name you choose. With a date in it (s2026) rotation is easy: publish a new selector, switch over, revoke the old one. DKIM2 (still a draft, not an RFC) uses this same public key in DNS; this record stays valid.

Without rua you can't see what goes wrong. Nobody reads dozens of XML reports a day by hand; in our experience DMARC Advisor is the best tool to process them. Enter the rua address you get there. If the address is on another domain, that domain has to accept the reports; the generator shows which record that takes.

Failure reports can contain personal data (addresses, subject lines) and few receivers still send them. Leave this empty unless you have a purpose for it, and mind the GDPR.

Relaxed is almost always right: news.contoso.com then counts as contoso.com. Use strict only if you deliberately keep subdomains apart.

Microsoft 365: *.mail.protection.outlook.com, or *.mx.microsoft if you moved to the new MX address with DNSSEC and DANE. During that move, list both.

Large senders (Google, Microsoft) send a daily JSON report about failed encrypted connections to your domain. Set this up before moving MTA-STS to enforce.

BIMI shows your logo next to the sender, but only when DMARC is at quarantine or reject. Gmail and Apple Mail require a VMC or CMC certificate; which mail apps show the logo differs per provider.