Configuring the SPF TXT record of a domain

Once you added a new Office 365 tenant to CodeTwo Admin Panel, the next recommended step is to configure the Sender Policy Framework (SPF) TXT record of your domain.

If you use CodeTwo Email Signatures for Office 365, your emails are routed through our cloud services located on Microsoft Azure servers. CodeTwo services need to be added to the list of authorized senders for your domain. This list is kept in the Sender Policy Framework (SPF) TXT record. By adding CodeTwo to your SPF record, you declare that you authorized the address of our service to process your mail traffic. This helps to avoid situations when your emails are treated as spam, junk, spoofing, or phishing by Exchange Online Protection (EOP).

Use the links below to learn how to configure an SPF record:

Why do I have to configure this record myself?

CodeTwo does not have access to your Office 365 login credentials (learn more about data safety) or to your domain registrar. That is why you need to edit the SPF record yourself.

If you use your own domain

If you have your own domain (e.g. my-company.com), you need to add the CodeTwo Email Signatures for Office 365 domain to your domain's SPF record. This must be done at your domain registrar's DNS configuration; you cannot set this up directly in Office 365.

Important

If you own several domains, you need to configure the CodeTwo SPF record for each domain separately.

Office 365 requires configuring SPF to prevent spoofing and phishing (learn more). Therefore, as the domain owner, you have probably already added an SPF TXT record for the Office 365 domain at your domain registrar's DNS (if you haven't, follow this article or this general instruction to do so). As a result, your SPF TXT record looks as shown below or similar:

v=spf1 include:spf.protection.outlook.com -all

You need to expand your SPF record by including one of the following entries:

These entries include the SPF address of the CodeTwo Email Azure Service domain. For everything to work correctly, you need to add the exact same entry as specified above (one of the two, depending on your software version). As a result, your SPF record should appear as shown below or similar (note that this example includes the SPF address of the version for global Office 365):

v=spf1 include:spf.protection.outlook.com include:spf.emailsignatures365.com -all

Be aware that this is just an example based on the default SPF record configuration for Office 365. Your SPF record may look different. For example, more domains may be included.

Notes

In all cases, your SPF TXT record needs to end with the all phrase. Please pay special attention to the sign (qualifier) which is directly before this phrase. It needs to be a hyphen (so the last entry is -all, as shown in the examples above) if you want all messages that do not fulfill your SPF definitions to be rejected/bounced. Learn more about SPF qualifiers

If you use the onmicrosoft.com domain

When you use the onmicrosoft.com domain (given to you by Microsoft when you first signed up for Office 365) in your Office 365 organization, you are not able to configure the SPF record yourself, because these domains are managed by Microsoft.

To update your SPF record to work with the CodeTwo software, you can:

  • contact Microsoft and ask them to update your SPF record (see the instructions above);
  • use your own domain instead - this is the recommended approach.

See next

Configuring Exchange Online connectors - learn how to automatically or manually configure Exchange Online connectors for the program: specify users in your Office 365 whose emails will be processed by the CodeTwo Email Azure Service.

Was this information useful?