Fix guide
How to Fix DMARC Alignment for Microsoft 365
Microsoft 365 DMARC alignment requires two CNAME records — selector1 and selector2 — added to your DNS. Without these, Microsoft signs email with their own domain instead of yours, causing DMARC alignment failures.
Why alignment fails
Without custom DKIM CNAMEs, messages may be signed in ways that don't align your From: domain. Pair this with a correct SPF record for Microsoft.
Exact DNS records (pattern)
Values are tenant-specific — copy from Defender. Typical pattern:
Step-by-step fix
Verify alignment and DNS in your browser
Open DNS Preflight →FAQ
Why does Microsoft 365 fail DMARC alignment?
By default M365 signs email using Microsoft's domain. You need to add selector1 and selector2 CNAME records so Microsoft can sign with your domain instead.
What are the exact CNAME values for M365 DKIM?
The values are in Microsoft 365 Defender → DKIM settings for your domain. They follow the pattern selector1-[domain]._domainkey.[tenant].onmicrosoft.com.
I added the CNAMEs but DKIM still fails — why?
You must also enable DKIM signing in the Defender portal after adding the CNAMEs. Adding the records alone is not enough.
Does Microsoft 365 SPF alignment work automatically?
Yes if you include include:spf.protection.outlook.com in your SPF record and your From: domain matches your M365 domain.
How do I verify M365 DMARC alignment is working?
Run DNS Preflight on your domain — the alignment engine checks selector1 and selector2 CNAMEs automatically and shows pass/fail.