Microsoft 365: selector1, selector2, and Outlook SPF.

22 October 2026

This guide covers Microsoft 365: where to copy SPF and DKIM values, how to publish them at your DNS provider, and how to point DMARC aggregate reports at a mailbox you control—or at Hosted DMARC on Sender Identity.

Before you change DNS

Run the free static audit and keep a copy of the current SPF and DMARC text.
List every system that already sends as this domain (office mail, billing, marketing, tickets).
Prefer one organizational-domain DMARC record. Subdomain records override the org policy when present.

Where to copy the values

Microsoft 365 Defender / Exchange admin → Email authentication / DKIM.
Enable DKIM for the domain. Microsoft gives two CNAMEs: selector1 and selector2 under ._domainkey.
Publish both CNAMEs, then enable signing.
SPF should include include:spf.protection.outlook.com.

Typical DNS shape

Type	Name / host	Value / points to	Note
`TXT`	`@`	`v=spf1 include:spf.protection.outlook.com -all`	Merge with existing includes; stay under 10 DNS lookups.
`CNAME`	`selector1._domainkey`	`selector1-brand-example._domainkey.domain.onmicrosoft.com`	Exact target is shown in the admin center.
`CNAME`	`selector2._domainkey`	`selector2-brand-example._domainkey.domain.onmicrosoft.com`	Keep both for key rotation.

DMARC aggregate reports

Two workable patterns:

Self-hosted mailbox. Publish v=DMARC1; p=none; rua=mailto:[email protected] on _dmarc.brand.example. The mailbox host must share the organizational domain, or you must authorize an external report host with a v=DMARC1 TXT at brand.example._report._dmarc.<report-host>.
Hosted DMARC. Remove the TXT at _dmarc, publish a CNAME to brand.example._dmarc.hosted.senderidentity.com, and let Sender Identity open a report mailbox at reports.senderidentity.com. Stages move only when you approve them: p=none, then p=quarantine at 25% and 50%, then p=reject.

The free audit suggests a starter p=none record for your own mailbox. It never writes p=reject and never points rua at reports.senderidentity.com—that only happens on the paid hosted path.

Verify

Wait for DNS, then run the free audit. Add any unusual DKIM selector under “DKIM selectors” if the default probe list misses it.
Sender Identity’s vendor catalog can label known includes and selectors in paid monitoring; labels never publish DNS for you.
Keep p=none until aggregate reports show only senders you recognize, then stage quarantine and reject in Account.