SPF checker for Microsoft 365

This checker reads a domain's live SPF record through a Microsoft 365 lens. A domain that sends with Microsoft 365 should publish a single SPF record, and that record should contain include:spf.protection.outlook.com, which is how the domain authorizes Microsoft's sending servers. The tool shows the record it found and gives a plain verdict on whether that Microsoft include is present.

SPF is only one part of the picture. For a general read of any SPF record, use the SPF Checker; to see SPF, DKIM and DMARC together, run the Email Authentication Checker, and you can also put that checker on your own site from the embed page.

If the verdict shows the Microsoft include is missing on a domain that sends from Microsoft 365, fix the existing record instead of adding a second one — two SPF records break the check for every sender. And if you would rather have the whole sending stack built and verified for you, see Start a build.

How to read your result

• PASS — Microsoft 365 is authorized: the SPF record includes spf.protection.outlook.com.
• SPF present, no Microsoft include: a record exists, but it authorizes other senders, not Microsoft 365. Mail sent from 365 inboxes on this domain can fail SPF.
• No SPF record: the domain publishes no sender authorization at all.
• Multiple SPF records: receivers treat this as a broken setup. Merge everything into one record.

FAQ

What include does Microsoft 365 need in SPF?

include:spf.protection.outlook.com, placed in the domain's single SPF record alongside any other senders.

Does Microsoft set this up automatically?

No. Microsoft provides the include value, but the record lives in your own DNS and only counts once it is published.

My SPF passes but mail still goes to spam. Why?

Check DKIM and DMARC as well. SPF on its own does not carry a domain; all three need to be in place and aligned.