SPF fix
How to Set Up SPF for Microsoft 365
Whitelabel M365 in SPF: add include:spf.protection.outlook.com to your single TXT — that’s their sending cloud.
DNS record
v=spf1 include:spf.protection.outlook.com ~all
Steps
Step 1 Check existing SPF record
Step 2 Add include:spf.protection.outlook.com
Step 3 Verify in DNS Preflight
Step 4 Also configure DKIM selectors for full alignment — see DKIM for Microsoft 365
Verify SPF and lookup count
Open DNS Preflight →FAQ
What is the Microsoft 365 SPF include?
include:spf.protection.outlook.com
Does this cover Exchange Online too?
Yes — spf.protection.outlook.com covers all Microsoft 365 and Exchange Online IPs.
I migrated from on-premise Exchange — do I need both includes?
Only if you still send from on-premise servers. Add ip4: entries for any on-premise IPs alongside the M365 include.
Why does M365 SPF sometimes fail even with the correct include?
Check for multiple SPF records — having two TXT records starting with v=spf1 causes immediate PermError.
How do I verify M365 SPF is working?
DNS Preflight shows whether spf.protection.outlook.com is present and whether the lookup count is within limits.