Article
Set up SPF to identify valid email sources for your custom ...
learn.microsoft.com
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
Valid mail sources: Valid sources of mail for the domain. Uses Domains, IP addresses, or both: Domains: include: values specify other services or domains as valid sources of mail from the original domain. These values ultimately lead to an IP address using DNS lookups. Most Microsoft 365 organizations require include:spf.protection.outlook.com in the SPF TXT record for the domain. Other non-Microsoft email services often require an additional include: value to identify the service as a valid source of email from the original domain. IP addresses: An IP address value includes both of the following elements: The value ip4: or ip6: to identify the type of IP address. The publicly resolvable IP address of the source email system. For example: An individual IP address (for example, 192.168.0.10). An IP address range using Classless Inter-Domain Routing (CIDR) notation (for example 192.168.0.1/26). Be sure that the range isn't too big or too small. In Microsoft 365, you typically use IP addresses in the SPF TXT record only if you have on-premises email servers that send mail from the Microsoft 365 domain (for example, Exchange Server hybrid deployments). Some non-Microsoft email services might also use an IP address range instead of an include: value in the SPF TXT record. “The DMARC policy specifies what to do to messages that fail SPF or DKIM, and DMARC reports allow you to validate the results.” Important points to remember:
Valid mail sources: Valid sources of mail for the domain. Uses Domains, IP addresses, or both: Domains: include: values specify other services or domains as valid sources of mail from the original domain. These values ultimately lead to an IP address using DNS lookups. Most Microsoft 365 organizations require include:spf.protection.outlook.com in the SPF TXT record for the domain. Other non-Microsoft email services often require an additional include: value to identify the service as a valid source of email from the original domain. IP addresses: An IP address value includes both of the following elements: The value ip4: or ip6: to identify the type of IP address. The publicly resolvable IP address of the source email system. For example: An individual IP address (for example, 192.168.0.10). An IP address range using Classless Inter-Domain Routing (CIDR) notation (for example 192.168.0.1/26). Be sure that the range isn't too big or too small. In Microsoft 365, you typically use IP addresses in the SPF TXT record only if you have on-premises email servers that send mail from the Microsoft 365 domain (for example, Exchange Server hybrid deployments). Some non-Microsoft email services might also use an IP address range instead of an include: value in the SPF TXT record. “DMARC treats -all (hard fail) and ~all (soft fail) as SPF failures.” Important points to remember:
Valid mail sources: Valid sources of mail for the domain. Uses Domains, IP addresses, or both: Domains: include: values specify other services or domains as valid sources of mail from the original domain. These values ultimately lead to an IP address using DNS lookups. Most Microsoft 365 organizations require include:spf.protection.outlook.com in the SPF TXT record for the domain. Other non-Microsoft email services often require an additional include: value to identify the service as a valid source of email from the original domain. IP addresses: An IP address value includes both of the following elements: The value ip4: or ip6: to identify the type of IP address. The publicly resolvable IP address of the source email system. For example: An individual IP address (for example, 192.168.0.10). An IP address range using Classless Inter-Domain Routing (CIDR) notation (for example 192.168.0.1/26). Be sure that the range isn't too big or too small. In Microsoft 365, you typically use IP addresses in the SPF TXT record only if you have on-premises email servers that send mail from the Microsoft 365 domain (for example, Exchange Server hybrid deployments). Some non-Microsoft email services might also use an IP address range instead of an include: value in the SPF TXT record. “But the DMARC policy is effectively ignored for SPF ~all failures if the messages don't also contain DKIM signatures.” Important points to remember:
Time to live (TTL): We recommend a minimum TTL value of 3600 seconds (one hour) on SPF TXT records to avoid DNS lookup timeouts. “In addition to preserving the reputation of your main email domain, not exceeding the number of DNS lookups is another reason to use subdomains for other email services that you don't control.” You can use free online tools to view your SPF TXT record and other DNS records for your domain. Some tools even calculate the number of DNS record lookups that your SPF TXT record requires.
Valid mail sources: Valid sources of mail for the domain. Uses Domains, IP addresses, or both: Domains: include: values specify other services or domains as valid sources of mail from the original domain. These values ultimately lead to an IP address using DNS lookups. Most Microsoft 365 organizations require include:spf.protection.outlook.com in the SPF TXT record for the domain. Other non-Microsoft email services often require an additional include: value to identify the service as a valid source of email from the original domain. IP addresses: An IP address value includes both of the following elements: The value ip4: or ip6: to identify the type of IP address. The publicly resolvable IP address of the source email system. For example: An individual IP address (for example, 192.168.0.10). An IP address range using Classless Inter-Domain Routing (CIDR) notation (for example 192.168.0.1/26). Be sure that the range isn't too big or too small. In Microsoft 365, you typically use IP addresses in the SPF TXT record only if you have on-premises email servers that send mail from the Microsoft 365 domain (for example, Exchange Server hybrid deployments). Some non-Microsoft email services might also use an IP address range instead of an include: value in the SPF TXT record. “We recommend -all so DMARC can act on messages that fail SPF if the messages also lack DKIM signatures.” Important points to remember:
Valid mail sources: Valid sources of mail for the domain. Uses Domains, IP addresses, or both: Domains: include: values specify other services or domains as valid sources of mail from the original domain. These values ultimately lead to an IP address using DNS lookups. Most Microsoft 365 organizations require include:spf.protection.outlook.com in the SPF TXT record for the domain. Other non-Microsoft email services often require an additional include: value to identify the service as a valid source of email from the original domain. IP addresses: An IP address value includes both of the following elements: The value ip4: or ip6: to identify the type of IP address. The publicly resolvable IP address of the source email system. For example: An individual IP address (for example, 192.168.0.10). An IP address range using Classless Inter-Domain Routing (CIDR) notation (for example 192.168.0.1/26). Be sure that the range isn't too big or too small. In Microsoft 365, you typically use IP addresses in the SPF TXT record only if you have on-premises email servers that send mail from the Microsoft 365 domain (for example, Exchange Server hybrid deployments). Some non-Microsoft email services might also use an IP address range instead of an include: value in the SPF TXT record. “The DMARC policy specifies what to do to messages that fail SPF or DKIM, and DMARC reports allow you to validate the results.” Important points to remember:
Sender Policy Framework (SPF) is a method of email authentication that helps validate mail sent from your Microsoft 365 organization to prevent spoofed senders that are used in business email compromise (BEC), ransomware, and other phishing attacks. “The primary purpose of SPF is to validate email sources for a domain.” For example, if your email domain in Microsoft 365 is contoso.com, you create an SPF TXT record in DNS for the contoso.com domain to identify Microsoft 365 as an authorized source of mail from contoso.com. Destination email systems check the SPF TXT record in contoso.com to determine whether the message came from an authorized source for contoso.com email.
In SPF records
Sender Policy Framework (SPF) is a method of email authentication that helps validate mail sent from your Microsoft 365 organization to prevent spoofed senders that are used in business email compromise (BEC), ransomware, and other phishing attacks. “Receiving email systems use the SPF TXT record to verify that email from the sender address used during the SMTP transmission of the message (known as the MAIL FROM address, 5321.MailFrom address, P1 sender, or envelope sender) is from a known, designated source of mail for that domain.” For example, if your email domain in Microsoft 365 is contoso.com, you create an SPF TXT record in DNS for the contoso.com domain to identify Microsoft 365 as an authorized source of mail from contoso.com. Destination email systems check the SPF TXT record in contoso.com to determine whether the message came from an authorized source for contoso.com email.
In SPF records
Before you get started, here's what you need to know about SPF in Microsoft 365 based on your email domain: “If you use only the Microsoft Online Email Routing Address (MOERA) domain for email (for example, contoso.onmicrosoft.com): You don't need to do anything.” If you use one or more custom domains for email (for example, contoso.com): The Microsoft 365 enrollment process already required you to create or modify the SPF TXT record in DNS for your custom domain to identify Microsoft 365 as an authorized mail source. But you still have more work to do for maximum email protection: Subdomain considerations: For email services that aren't under your direct control (for example, bulk email services), we recommend using a subdomain (for example, marketing.contoso.com) instead of your main email domain (for example, contoso.com). You don't want issues with mail sent from those email services to affect the reputation of mail sent by employees in your main email domain. For more information about adding subdomains, see Can I add custom subdomains or multiple domains to Microsoft 365?. Each subdomain that you use to send email from Microsoft 365 requires its own SPF TXT record. For example, the SPF TXT record for contoso.com doesn't cover marketing.contoso.com; marketing.contoso.com needs its own SPF TXT record. If you own registered but unused domains: If you own registered domains that aren't used for email or anything at all (also known as parked domains), configure SPF TXT records to indicate that no email should ever come from those domains as described in Scenario: Parked domains.
In SPF records
Before you get started, here's what you need to know about SPF in Microsoft 365 based on your email domain: “The SPF TXT record is already configured for you.” If you use one or more custom domains for email (for example, contoso.com): The Microsoft 365 enrollment process already required you to create or modify the SPF TXT record in DNS for your custom domain to identify Microsoft 365 as an authorized mail source. But you still have more work to do for maximum email protection: Subdomain considerations: For email services that aren't under your direct control (for example, bulk email services), we recommend using a subdomain (for example, marketing.contoso.com) instead of your main email domain (for example, contoso.com). You don't want issues with mail sent from those email services to affect the reputation of mail sent by employees in your main email domain. For more information about adding subdomains, see Can I add custom subdomains or multiple domains to Microsoft 365?. Each subdomain that you use to send email from Microsoft 365 requires its own SPF TXT record. For example, the SPF TXT record for contoso.com doesn't cover marketing.contoso.com; marketing.contoso.com needs its own SPF TXT record. If you own registered but unused domains: If you own registered domains that aren't used for email or anything at all (also known as parked domains), configure SPF TXT records to indicate that no email should ever come from those domains as described in Scenario: Parked domains.
In SPF records
Sender Policy Framework (SPF) is a method of email authentication that helps validate mail sent from your Microsoft 365 organization to prevent spoofed senders that are used in business email compromise (BEC), ransomware, and other phishing attacks. “Specifically, SPF uses a TXT record in DNS to identify valid sources of mail for the domain.” For example, if your email domain in Microsoft 365 is contoso.com, you create an SPF TXT record in DNS for the contoso.com domain to identify Microsoft 365 as an authorized source of mail from contoso.com. Destination email systems check the SPF TXT record in contoso.com to determine whether the message came from an authorized source for contoso.com email.
In SPF records
The primary purpose of SPF is to validate email sources for a domain. Specifically, SPF uses a TXT record in DNS to identify valid sources of mail for the domain. Receiving email systems use the SPF TXT record to verify that email from the sender address used during the SMTP transmission of the message (known as the MAIL FROM address, 5321.MailFrom address, P1 sender, or envelope sender) is from a known, designated source of mail for that domain. “if your email domain in Microsoft 365 is contoso.com, you create an SPF TXT record in DNS for the contoso.com domain to identify Microsoft 365 as an authorized source of mail from contoso.com.” Before you get started, here's what you need to know about SPF in Microsoft 365 based on your email domain:
In SPF records
Time to live (TTL): We recommend a minimum TTL value of 3600 seconds (one hour) on SPF TXT records to avoid DNS lookup timeouts. “In addition to preserving the reputation of your main email domain, not exceeding the number of DNS lookups is another reason to use subdomains for other email services that you don't control.” You can use free online tools to view your SPF TXT record and other DNS records for your domain. Some tools even calculate the number of DNS record lookups that your SPF TXT record requires.