DMARC policies for Outlook and Microsoft 365: setup and requirements

Microsoft weights sender reputation via SNDS and JMRP, and rejects unauthenticated bulk mail to consumer Outlook.com addresses.

What DMARC policies are#

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when a message fails SPF and DKIM alignment, and asks them to send aggregate and forensic reports back to the domain owner.

Why it matters#

DMARC at p=reject is what actually stops exact-domain spoofing. Gmail and Yahoo require at least p=none for bulk senders, and BIMI requires p=quarantine or p=reject.

Setting up DMARC policies for Outlook and Microsoft 365#

1. Confirm SPF and DKIM are deployed and aligned for every legitimate sender.
2. Publish _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com to begin collecting reports.
3. Analyze aggregate (RUA) reports for 2 to 4 weeks to identify unauthenticated legitimate sources.
4. Fix each source, then move to p=quarantine with pct=25, ramping to 100.
5. Move to p=reject and add sp=reject to cover subdomains.

_dmarc.example.com.  IN TXT  "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-rua@example.com; adkim=s; aspf=s; pct=100"

How Outlook and Microsoft 365 reports results#

Open a delivered test message in Outlook and Microsoft 365 and view the original or headers. Look for Authentication-Results and any provider-specific verdict headers. Use the provider's sender dashboard for aggregate reputation.

Common mistakes#

• Jumping straight to p=reject and blocking your own invoicing or HR system.
• Sending RUA reports to a mailbox nobody reads; use a report processor.
• Leaving subdomains uncovered because sp= was never set.
• Assuming p=none provides protection; it is monitoring only.

Frequently asked questions#