Setup guide
The SPF record Microsoft 365 needs, the versions for government and China clouds, and how to add other senders.
v=spf1 include:spf.protection.outlook.com -all
Add it as a TXT record at the root of your domain (name @). Microsoft’s own guidance ends the record with -all, which tells inboxes to reject email from anyone not listed. If you’re still finding all your senders, ~all is the safer choice until you are sure.
The include above is for standard Microsoft 365. Microsoft 365 for US government (GCC High and DoD) uses include:spf.protection.office365.us, and Microsoft 365 operated by 21Vianet in China uses include:spf.protection.partner.outlook.cn.
v=spf1 include:spf.protection.outlook.com include:sendgrid.net include:mail.zendesk.com -all
Keep it to one record and under 10 DNS lookups. The SPF record generator builds it and counts the lookups.
Check for an existing SPF record and edit it instead of adding a second.
Add or edit the TXT record at @ where your DNS is managed.
Switch on DKIM as well: set up DKIM in Microsoft 365.
Check it with the SPF checker.
