Publish an SPF record that fails unauthorized senders for every domain

Description

Every accepted domain of the tenant, and every other domain the organization owns, publishes exactly one SPF TXT record in DNS that:

• lists only the real sources of mail for the domain (for Microsoft 365, include:spf.protection.outlook.com; on-premises servers and third-party senders by IP address or include:);
• ends with the enforcement rule {{ spf_qualifier }} (never +all or ?all);
• needs no more than 10 DNS lookups.

Domains that never send mail (parked domains) publish v=spf1 -all whatever the parameter value. The *.onmicrosoft.com domain is managed by Microsoft and is out of scope.

Rationale

SPF is the first of the three email authentication checks (SPF, DKIM, DMARC) that let receivers, including Exchange Online itself, reject mail forged with the organization's domains. Without an enforcing SPF record, DMARC can only rely on DKIM and spoofed messages are more likely to be delivered. Microsoft recommends -all for domains that also have DKIM and DMARC.

Impact

A missing sender in the record (marketing platform, ticketing tool, on-premises relay) makes its messages fail SPF; with DMARC enforcement they may be rejected. Inventory the senders with DMARC aggregate reports before tightening the record. Moving third-party senders to a subdomain keeps the main domain within the 10-lookup limit.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global Reader, browse to Settings > Domains and list the domains. Add the domains the organization owns outside the tenant (registrar inventory).
2. For each domain, query DNS (no tenant role needed):

   Get-AcceptedDomain | ForEach-Object {
     Resolve-DnsName -Name $_.DomainName -Type TXT -ErrorAction SilentlyContinue |
       Where-Object { $_.Strings -like 'v=spf1*' } | Select-Object Name, Strings
   }
   

   (nslookup -type=TXT example.com or dig TXT example.com give the same result.)
3. Fail if a domain has no SPF record, has more than one, ends with +all or ?all, ends with ~all while the parameter requires -all, exceeds 10 DNS lookups, or if a parked domain does not publish v=spf1 -all.

Remediation

1. Inventory the systems that send mail with each domain (DMARC aggregate reports help).
2. At the DNS hosting provider, create or update the single TXT record at the domain apex, for example:

   v=spf1 include:spf.protection.outlook.com -all
   

   Add ip4:, ip6: or include: entries for the other real senders, and use ~all only where the parameter allows it.
3. For parked domains, publish v=spf1 -all (and, if the provider supports it, a wildcard TXT record with the same value for subdomains).
4. Check the record with a lookup counter, and watch DMARC reports for SPF failures.

Rollback

Restore the previous TXT record value at the DNS hosting provider.

References

• Set up SPF to identify valid email sources for your Microsoft 365 domain Microsoft, vendor-doc, accessed 2026-10-24
• RFC 7208: Sender Policy Framework (SPF) IETF, rfc, accessed 2026-10-24
• CISA SCuBA Exchange Online baseline CISA, standard, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-235) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-015 Sign outgoing mail with DKIM for every sending domain
• related CB-M365-MAIL-016 Publish an enforcing DMARC policy with reporting for every domain

People and lifecycle