MailFixIt

Microsoft 365 email configuration guide

Microsoft 365: SPF record for provider sending

Microsoft 365 may be absent from the effective SPF policy, or another SPF record may make evaluation fail.

Problem description

A provider setup symptom may look like:

SPF record for provider sending after a provider DNS change.

Check the sending domain

What this usually means

The envelope domain checked by the receiver does not authorize Microsoft 365, or multiple SPF TXT records make the result invalid.

Fix it

  1. Read a recent header or NDR to identify the envelope MAIL FROM domain.
  2. Inventory Exchange Online plus every application, device, CRM, and provider that still sends for that domain.
  3. At the envelope domain, keep one TXT record beginning with v=spf1.
  4. Merge Microsoft 365’s current documented authorization mechanism into that policy without removing other active senders.
  5. Publish it, send a new message through Microsoft 365, and confirm spf=pass for the intended domain and IP.

Common mistake

The visible From domain is not always the SPF domain. A second SPF record causes a permanent error, and blindly replacing the policy can break scanners, websites, or business applications.

What MailFixIt can check

MailFixIt can trace public SPF mechanisms and their DNS dependencies. It cannot discover private tenant senders that are missing from both DNS and the supplied message.

Use the related SPF guides for duplicate records, lookup limits, or an unexpected envelope subdomain.

Frequently asked questions

What does MailFixIt check for Microsoft 365?

It can detect duplicate SPF records, invalid syntax, failed includes, and visible address authorization. A message header is required to confirm the evaluated envelope domain.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Microsoft 365 official setup guidance.