Microsoft 365 / Office 365 SPF record

Microsoft 365 (formerly Office 365) sends all Exchange Online mail from a single, all-IP include that costs just one DNS lookup. It is one of the best-behaved includes you will add — the problem is almost never Microsoft itself, but everything else stacked alongside it.

The SPF include for Microsoft 365 / Office 365

Authorize Microsoft 365 / Office 365 by adding its mechanism to your single SPF TXT record:

v=spf1 include:spf.protection.outlook.com ~all

Approximate lookup cost: 1 DNS lookup(s). Remember you have a budget of 10 total across every sender in the record.

Provider include values change occasionally. Confirm the current value in your Microsoft 365 / Office 365 admin console before publishing, and never create a second v=spf1 record — a domain may have only one. Combine all senders into one record:

v=spf1 include:spf.protection.outlook.com include:spf.protection.outlook.com ~all

If you also relay through a connector, a marketing platform, or a CRM, those add their own lookups on top of Microsoft’s. That combination is the classic path to a too-many-lookups permerror.

When adding Microsoft 365 / Office 365 pushes you over the limit

Every include you stack — your mailbox provider, this one, a marketing tool, a help desk — adds to the same 10-lookup budget. The moment recursive expansion crosses 10, receivers return permerror and your SPF stops passing. You cannot shrink the nested provider records, so the durable fix is to flatten the record or move to a single-lookup macro that stays in sync automatically.