Fix SPF, DKIM and DMARC Failures in Exchange Online (Emails Going to Spam)
Mail from your domain lands in spam or bounces with 5.7.509? Configure SPF, enable DKIM signing with PowerShell and publish a safe DMARC policy.
Common Symptoms and Quick Fixes
| Symptom | Likely Cause | Quick Fix |
|---|---|---|
| Mail goes to Gmail spam | SPF or DKIM missing | Publish SPF and enable DKIM |
| 550 5.7.509 domain does not pass DMARC | DMARC policy with failing SPF and DKIM alignment | Fix SPF/DKIM then recheck |
| Two SPF records | More than one TXT starting v=spf1 | Merge into a single record |
Method 1: Publish One Correct SPF Record
Create a single TXT record at the root of your domain. Never publish two SPF records.
v=spf1 include:spf.protection.outlook.com -allPro Tip for AdministratorsIf you also send through other services (marketing tools, CRM), add their include: entries in the same record.
Method 2: Enable DKIM Signing
Connect to Exchange Online PowerShell and read the two CNAME targets for your domain.
Connect-ExchangeOnline
Get-DkimSigningConfig -Identity contoso.com | Format-List Selector1CNAME, Selector2CNAME1
Publish both CNAMEsCreate selector1._domainkey and selector2._domainkey CNAME records in DNS using the values from the command above.
2
Enable signing after DNS propagatesRun the command below.
Turn on DKIM and verify
Run this once the CNAME records resolve.
Set-DkimSigningConfig -Identity contoso.com -Enabled $true
Get-DkimSigningConfig -Identity contoso.com | Format-List Enabled, StatusMethod 3: Publish a DMARC Record
Add a TXT record at _dmarc.yourdomain.com. Start in monitoring mode.
v=DMARC1; p=none; rua=mailto:dmarc@contoso.com
nslookup -type=txt _dmarc.contoso.comPro Tip for AdministratorsStay on p=none for two to four weeks and review the reports before moving to p=quarantine and then p=reject.
Frequently Asked Questions (FAQ)
Q: How long do DNS changes take?
Usually minutes, but allow up to 48 hours depending on TTL.
Q: Do I need DKIM if I have SPF?
Yes. DMARC passes if either aligns, but forwarded mail breaks SPF, so DKIM keeps your mail deliverable.