Step 1 — Check the current state

Resolve-DnsName -Name "_dmarc.company.com" -Type TXT
Resolve-DnsName -Name "company.com" -Type TXT                        # SPF
Resolve-DnsName -Name "selector1._domainkey.company.com" -Type CNAME  # DKIM in M365

Step 2 — Enable aggregate reporting (two weeks minimum)

TXT record at _dmarc.company.com:

v=DMARC1; p=none; rua=mailto:dmarc@company.com; ruf=mailto:dmarc@company.com; fo=1; pct=100

Don’t skip this. The rua reports are daily XML from Google, Microsoft and Yahoo — they’re exactly what shows you which systems legitimately send on your domain’s behalf.

Step 3 — Inventory your legitimate senders

The reports will surface systems you forgot about: the ERP sending invoices, the multifunction printer with scan-to-email, Mailchimp, the website contact form, the recruiting platform. Each one needs to pass SPF or DKIM with domain alignment.

Step 4 — Fix SPF without blowing the lookup limit

SPF allows a maximum of 10 DNS lookups. One include: per vendor burns through them fast, and past the limit the record becomes a permerror — meaning completely invalid:

v=spf1 include:spf.protection.outlook.com include:_spf.vendor.com ip4:81.180.x.x -all

Count your lookups before publishing. -all (hard fail) is the target, not ~all.

Step 5 — Sign DKIM for every sender

In M365: Defender → Policies → Email authentication → DKIM → select the domain → publish the two CNAMEs shown → enable. Third-party vendors each have their own selector, which must be added separately.

Step 6 — Escalate gradually with pct

This is the part missing from 90% of guides — don’t jump straight to reject:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@company.com

After a week with no complaints → pct=50, then pct=100. Only then:

v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@company.com; adkim=s; aspf=s

Step 7 — Protect subdomains too

Attackers will use invoices.company.com if the main domain is locked down. Add sp=reject to the main record, plus an explicit DMARC record on any subdomain that doesn’t send mail.

Pitfall: automatic forwarding (someone redirecting their work mail to Gmail) breaks SPF by design. Only DKIM survives forwarding — which is why both mechanisms need to be configured, not just one.