Microsoft 365 DMARC Not Working – Fix Domain Alignment and Policy (2026)

Microsoft 365 DMARC fails when SPF or DKIM authentication does not align with the visible From domain, even if mail sends normally. This commonly appears when Microsoft tenant defaults are active but custom-domain alignment was never fully completed. Often the first step is confirming you even have a DMARC record and that the policy value matches your enforcement goal.

Last updated: 3/27/2026

If policies are not enforced, review the DMARC setup guide.

Learn the bigger picture in our Email Authentication Explained guide and compare SPF vs DKIM vs DMARC to understand how these protocols work together.

One-Minute Fix

Publish a valid DMARC policy at _dmarc.yourdomain, ensure Microsoft 365 DKIM is enabled for the custom domain, and verify SPF/DKIM alignment in real message headers.

Correct Microsoft 365 DMARC record

DNS TXT

v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r

Use monitoring first, then increase policy strength after alignment is consistently passing for all legitimate Microsoft 365 sending flows.

Run free check

Free live DNS check. No signup required.

Wrong vs correct setup

Wrong setup

Email header + DNS

From: alerts@example.com
DKIM-Signature: d=example.onmicrosoft.com; s=selector1;
_dmarc.example.com TXT "v=DMARC1; p=reject;"

This can fail DMARC alignment for example.com if signing/alignment is not configured to match the visible From domain. Strict reject policy may impact legitimate traffic prematurely.

Correct setup

Email header + DNS

From: alerts@example.com
DKIM-Signature: d=example.com; s=selector1;
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r"

Aligned signing plus monitoring policy provides safe visibility and predictable rollout. Enforcement can be increased after report-backed validation.

Why this happens

DMARC on Microsoft 365 often fails when DKIM is technically enabled but domain alignment is not set up for the visible From identity. SPF paths can also align to a different return-path domain. DMARC requires at least one aligned authentication path, not just a pass result. Misaligned authentication paths often show up as DMARC alignment failures or a reporting address that never receives data.

Why this is a problem

If DMARC fails on Microsoft 365 traffic, receivers may downgrade trust or enforce quarantine/reject depending on policy. Legitimate corporate mail can be filtered inconsistently, while spoofing controls remain weaker than expected. Over time that can mean critical mail is treated like generic bulk, especially when multiple DMARC records or a misconfigured fo= tag confuse evaluation.

How this affects deliverability

Consistent DMARC alignment for Microsoft 365 helps preserve sender reputation and inbox placement for business-critical traffic. Misalignment increases spam risk and creates unstable enforcement behavior across providers. Over time, well-tuned DMARC aggregate reports and a clear policy stance are what help inbox providers separate your legitimate traffic from spoofing attempts.

Common causes

DKIM was not fully enabled for the custom domain in Microsoft 365.
SPF or DKIM authenticated a non-aligned domain.
DMARC policy was enforced before alignment gaps were fixed.
DNS propagation delays hid recent DMARC/DKIM corrections.

What we checked

We checked DMARC record validity and whether Microsoft 365 mail can provide aligned SPF or DKIM results for the visible From domain under current policy settings.

Live DNS lookup. No login. No saved domains. No tracking.

FAQ

Can Microsoft 365 pass DKIM and still fail DMARC?

Yes. DKIM pass alone is not enough if the signing domain is not aligned with the From domain.

Should I keep DMARC at p=none for Microsoft 365?

Use p=none during monitoring, then move to enforcement once reports and headers confirm stable alignment.

What is the fastest way to validate Microsoft 365 DMARC?

Send a real message, inspect SPF/DKIM alignment in headers, and confirm report trends from your rua destination.

Next steps

Send a real Microsoft 365 message and inspect alignment in headers.
Enable/verify DKIM for the exact custom domain in Microsoft 365.
Publish or correct DMARC at _dmarc with p=none and rua reporting.
Resolve failing sources shown in DMARC aggregate reports.
Increase enforcement only after stable aligned pass rates.
Review the full troubleshooting guidance in the DMARC Hub.
Explore sender authorization issues in the SPF Hub.
Check signing and selector issues in the DKIM Hub.