Azure SPF Configuration Tutorial
Microsoft 365 (formerly Office 365) recommends a simple SPF record that includes their sending infrastructure. However, many organizations use additional mail sources (marketing, transactional, ticketing). This tutorial shows how to publish a correct SPF record in Cloudflare, handle multiple senders, and validate alignment for DMARC.
Base SPF Record
For domains sending exclusively via Microsoft 365:
example.com. IN TXT "v=spf1 include:spf.protection.outlook.com -all"
The -all (hard fail) indicates that only listed mechanisms may send. If you are migrating, start with ~all (soft fail) temporarily while discovering all senders.
Adding Other Providers
Include vendor-provided includes or IPs:
v=spf1 include:spf.protection.outlook.com include:_spf.yourvendor.com ip4:203.0.113.10 -all
- Prefer vendor-managed
include: over copying IP ranges; providers rotate IPs.
- Keep total DNS mechanisms under 10 to avoid SPF permerror (too many lookups).
MAIL FROM and Alignment
SPF checks the envelope sender (return-path). To achieve DMARC alignment, ensure the organizational domain matches the visible From: address or use custom return-paths on non-Microsoft senders that align to your domain.
Publishing in Cloudflare
- Open your zone and add a TXT record on the root (or specific subdomain).
- Paste the complete SPF value exactly as a single string.
- Use a short TTL during changes; increase after stable.
Validation
- Send test emails and check headers for
Received-SPF and Authentication-Results.
- Use online SPF evaluators to confirm there are fewer than 10 DNS lookups.
- For forwarding paths, rely on DKIM for DMARC alignment if SPF fails.
Common Pitfalls
- Duplicate SPF records: only one TXT SPF record should exist per domain.
- Overlong records: use
include: and remove unused vendors.
- HELO identity issues: ensure your outbound systems present correct HELO/EHLO names, especially for on-prem relays.
With a carefully designed SPF record and DKIM/DMARC alignment, Microsoft 365 domains maximize deliverability while preventing spoofed messages.
