Microsoft 365 Emails Going to Spam? The Authentication Checklist

Last updated: October 2026

If your business runs on Microsoft 365 and your mail keeps landing in clients' spam folders, there's one setting to check before all others — because on most 365 tenants it's silently off. DKIM signing for your own domain is not enabled by default in Microsoft 365. Microsoft signs mail for your tenant.onmicrosoft.com address automatically, but your real domain — the one on your invoices and your website — sends unsigned until an admin turns it on. Unsigned mail from a business domain is exactly what modern spam filters are trained to distrust.

The quick test: send from your 365 mailbox to a personal Gmail address, open the message, three dots → "Show original." Note which of SPF, DKIM and DMARC say PASS. Then work this checklist in order.

1. SPF: one record, Microsoft's include merged in

Your domain root needs exactly one TXT record beginning v=spf1, containing include:spf.protection.outlook.com. Resolved live, Microsoft's record is pure IP ranges, so the include costs exactly 1 of your 10 allowed DNS lookups — cheap. The failures to look for:

• Two SPF records (a leftover plus a new one) — receivers treat that as a permerror: SPF fails even though both records look fine.
• Missing senders — every other platform that sends as your domain (newsletter tool, CRM, invoicing app, website) needs its mechanism merged into this same record, not a record of its own.
• Lookup creep — each addition spends from the same 10-lookup budget; a Zoho-sized include can eat half of it. See the lookup guide before your record gets there.

2. DKIM: create the keys, publish two CNAMEs, switch it on

1. Open the Microsoft Defender portal (security.microsoft.com) → Email & collaboration → Policies & rules → Threat policies → Email authentication settings, then the DKIM tab.
2. Select your domain and choose "Create DKIM keys." The portal displays two CNAME records. Their values contain your tenant name and look like selector1-yourbusiness-com._domainkey.yourtenant.onmicrosoft.com — copy them exactly; the pattern can't be guessed.
3. Publish both CNAMEs in DNS: hosts selector1._domainkey and selector2._domainkey. (Two selectors exist so Microsoft can rotate keys without downtime.)
4. Return to the portal and toggle on "Sign messages for this domain with DKIM signatures." If it errors, the CNAMEs aren't resolving yet — wait and retry rather than recreating keys.
5. Verify with the Gmail "Show original" test: DKIM should now PASS with your domain.

Why this matters more than it looks: of the two DMARC legs, DKIM is the one that survives forwarding, mailing lists and most "send on behalf of" tooling. For a lot of 365 shops, turning this on is the single change that moves mail out of spam.

3. DMARC: publish at p=none, then climb

Use a report address on your domain that someone actually reads — the reports are how you'll know every other sender (the CRM, the website) is passing before enforcement. Stay at p=none for one to two clean weeks, then p=quarantine, then p=reject. Jumping straight to reject before your other senders are authenticated is how businesses block their own invoices; the full staged process is in the DMARC setup guide, and the policy differences are covered in p=none vs p=quarantine vs p=reject.

4. The rule your recipients' inboxes enforce: 550 5.7.515

Since May 5, 2025, Microsoft has required domains sending more than 5,000 messages a day to its consumer mailboxes (Outlook.com, Hotmail, Live) to pass SPF and DKIM and publish an aligned DMARC record — and it doesn't junk-folder non-compliant bulk mail, it rejects it with 550 5.7.515 "Access denied, sending domain does not meet the required authentication level." Google and Yahoo run the equivalent regime since February 2024. Most small businesses never send 5,000 a day — but the threshold counts all platforms using your domain together, it's permanent once crossed, and the filters that decide your everyday placement use the same authentication signals. The checklist above is the whole compliance story.

5. Still in spam with everything passing?

Then the problem has moved from identity to reputation: complaint rates (keep them under 0.3%), cold or purchased lists, or content patterns. One Microsoft-specific note: mail sent "on behalf of" through third-party tools frequently passes SPF for the tool's domain while failing alignment for yours — in "Show original," alignment means the passing domain matches your From: domain. A tool that can't DKIM-sign with your domain will keep failing DMARC no matter how clean your 365 setup is; authenticate it (our Mailchimp guide shows the pattern) or send from a subdomain instead.