Microsoft 365 Email Going to Spam? Fix SPF, DKIM and DMARC Properly

By Stackvora Team · 2026-08-09 · 10 min read

If your Microsoft 365 mail lands in junk folders, the cause is almost always authentication, not content. Google and Microsoft both now require authenticated, aligned mail from bulk senders — an unaligned domain gets filtered before a human ever reads it.

The three records, in plain terms

• SPF lists which servers may send for your domain.
• DKIM cryptographically signs each message so it cannot be altered or forged.
• DMARC tells receivers what to do when SPF and DKIM fail, and sends you reports.

All three must align with the domain in the visible From address. Passing SPF for a mail vendor's domain while your From says example.com does nothing for DMARC.

Step 1: One correct SPF record

A domain may have exactly one SPF TXT record. Two records means both are ignored.

v=spf1 include:spf.protection.outlook.com include:mailer.example.net -all

Rules that matter:

• Stay under the 10 DNS-lookup limit. Each include counts, and nested includes count too. Exceeding it produces a permanent error and SPF fails outright.
• Use -all (hard fail) once you are confident every legitimate sender is listed. ~all is a reasonable staging step.
• Add every system that sends as your domain: CRM, ticketing, marketing platform, scanners, application servers.

Verify with nslookup -type=txt example.com and any SPF-lookup counter.

Step 2: Enable DKIM for your custom domain

Microsoft 365 signs with onmicrosoft.com by default, which does not align with your domain. Publish two CNAMEs:

selector1._domainkey.example.com  →  selector1-example-com._domainkey.tenant.onmicrosoft.com
selector2._domainkey.example.com  →  selector2-example-com._domainkey.tenant.onmicrosoft.com

Then enable signing in the Defender portal or via PowerShell:

Connect-ExchangeOnline
New-DkimSigningConfig -DomainName example.com -Enabled $true
Get-DkimSigningConfig | Format-List Domain,Enabled,Status

Third-party senders each need their own DKIM keys published on your domain — one platform's key does not cover another.

Step 3: Roll out DMARC without breaking mail

Start in monitor mode and read the data for two to four weeks:

_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1; pct=100"

Then tighten in stages:

Never jump straight to p=reject. Almost every organisation discovers at least one forgotten sender — a scan-to-email printer, an invoicing system, a legacy CRM — during stage 1.

Step 4: Read the reports

Aggregate (RUA) reports arrive as XML. Use a DMARC reporting service or parse them yourself; what matters is a list of sending IPs, whether SPF and DKIM passed, and whether they aligned. Anything sending legitimately but failing alignment needs either an SPF include or its own DKIM key before you tighten policy.

Other deliverability factors

• Reverse DNS for any on-premises relay must match its HELO name.
• Blocklists — check your egress IPs on Spamhaus and the Microsoft SNDS programme.
• List hygiene — repeated sends to dead addresses damage reputation faster than any header issue.
• One-click unsubscribe is now required for bulk senders by major providers.
• Consistent From addresses — rotating sender addresses looks like spam behaviour.

Verification checklist

1. Exactly one SPF record, under 10 lookups, all senders listed.
2. DKIM enabled for the custom domain, status Valid.
3. DMARC published with a monitored reporting mailbox.
4. Send a test to an external mailbox and inspect the headers for dkim=pass, spf=pass, dmarc=pass.
5. Re-test after every new sending platform is added.

Subdomains and third-party senders

Send marketing and transactional mail from dedicated subdomains such as news.example.com and mail.example.com. Reputation is tracked per sending domain, so a bad campaign then damages the subdomain rather than the corporate mail that pays your invoices. Each subdomain needs its own SPF record and DKIM keys; DMARC can be inherited from the organisational domain, or overridden per subdomain with an explicit _dmarc.news record.

Be explicit about the sp= tag when you enforce. Without it, a strict policy on the main domain also applies to every subdomain — including ones a department set up without telling you, which is exactly how a payroll notification system suddenly stops delivering.

What to check when only one recipient domain filters you

If mail reaches most recipients but one large provider junks it, authentication is probably fine and reputation is the issue. Check that provider's postmaster tools, look for a recent volume spike, review complaint rates, and confirm you are not sending to addresses harvested years ago. Warming a new sending IP gradually over two weeks avoids the volume-spike penalty entirely.

Fix alignment first and junk-folder complaints usually disappear within days. Paste your raw message headers into Stackvora AI for an authentication read, and see the knowledge base for connector and hybrid mail-flow guides.