On this page

Fixing SPF in AWS Route 53 for Microsoft 365

What this fixes

SPF lists which servers are authorized to send mail for your domain. See Fixing SPF Record Issues for what it does and why it matters — this guide gives you the exact record for Microsoft 365 and where to add it in Route 53.

This assumes you already have a hosted zone in Route 53 for your domain, and IAM permissions to edit it.

The record

v=spf1 include:spf.protection.outlook.com -all

Microsoft recommends -all (hard fail) provided DKIM and DMARC are also configured. If your tenant is in GCC High/DoD, use include:spf.protection.office365.us; in the China 21Vianet cloud, use include:spf.protection.partner.outlook.cn.

How to add it in Route 53

  1. Open the Route 53 console and go to Hosted zones → select your domain's hosted zone.
  2. Click Create record.
  3. Leave Record name as your root domain.
  4. Set Record type to TXT.
  5. Under Value, enter the record in quotes: "v=spf1 include:spf.protection.outlook.com -all" — Route 53 requires TXT values to be wrapped in double quotes.
  6. Leave TTL at the default (300s is fine).
  7. Click Create records.
  8. Re-run your scan to confirm.

If an SPF TXT record already exists, edit it rather than creating a second one.

Common pitfalls

  • Forgetting to wrap the TXT value in double quotes — Route 53 will otherwise reject or mis-parse the record.
  • Using the standard commercial-cloud include when your tenant is actually in GCC High or the China cloud.