Learn about DMARC, SPF, and DKIM

If you set up Microsoft 365 DKIM for a custom domain from muscle memory, there is a good chance the DNS targets you expect are now wrong.

Microsoft updated the DKIM CNAME format for new custom domains in May 2025. The selectors no longer always point to the older selector1-example-com._domainke...

Yes, this really happens.

A message can leave the sender with one clean-looking authentication story, then land at Provider A with a DMARC pass and at Provider B with a DMARC fail, or with the same DMARC result but a very different final disposition. That is not necessarily evidence that one recei...

Publishing DMARC is an important milestone, but it is not the finish line for deliverability.

After SPF, DKIM, and DMARC are in place, mailbox providers still make inbox and spam decisions based on sender reputation, user complaints, list quality, traffic consistency, and overall message quality.

Microsoft 365 email authentication gets confusing faster than it should, mostly because every tenant has at least two domain stories happening at once:

• your real public domain, like example.com
• the tenant's built-in .onmicrosoft.com domain

And those two do not behave the same way.

T...