Microsoft 365 DNS Record Generator

Step 1: Domains

Default Microsoft 365 tenant domain

.onmicrosoft.com

Your custom domain

SPF

SPF Failure mode

Hard Fail (-all) Soft Fail (~all)

DMARC

DMARC Policy

Advanced DMARC settings (optional)

DKIM Alignment (adkim)

SPF Alignment (aspf)

Percentage (pct)

Failure Options (fo)

Report Format (rf)

Report Interval (ri)

DMARC Aggregation (RUA) email address

DMARC Forensics (RUF) email address

MTA-STS

Enable MTA-STS DNS record

MTA-STS id date

MTA-STS report email (rua)

SMTP DANE

Use the following PowerShell commands to enable DNSSEC and SMTP DANE for your verified domain.

Enable DNSSEC command

Enable SMTP DANE inbound command