SPF record for Microsoft 365 and Mailchimp
One record, both providers, and the honest lookup arithmetic so you know how much budget you have left.
The record
The single most common mistake here is publishing a second SPF record for the second provider — often because the provider's setup wizard says "add this TXT record". RFC 7208 §3.2 allows exactly one SPF record per domain. With two, receivers return permerror and treat your domain as having no SPF at all, which is strictly worse than having only one of the two providers listed.
The lookup budget
| Provider | Include | Lookups |
|---|---|---|
| Microsoft 365 | spf.protection.outlook.com | 1 |
| Mailchimp | servers.mcsv.net | 1 |
Also fully flattened, so one lookup. Microsoft uses two rotating DKIM selectors published as CNAMEs; if only selector1 exists, the setup was not completed.
Flat ip4-only record, one lookup. Mailchimp also authenticates via its own domain by default, so many senders do not need this include at all — check whether you actually use a custom From domain.
Check your own domain first
Before changing anything, see what you currently have. The checker expands your whole include chain and counts the lookups the way a receiver does.
DKIM for both
SPF covers the server; DKIM covers the message and survives forwarding. You need it from both providers independently:
| Provider | Selector | Published as |
|---|---|---|
| Microsoft 365 | selector1 and selector2 | two CNAMEs to *.dkim.mail.microsoft |
| Mailchimp | k1 | CNAME to dkim.mcsv.net |
Different selectors do not conflict — that is exactly what selectors are for. A domain can carry any number of DKIM keys at once.
And DMARC on top
With two senders, DMARC reporting stops being optional. It is the only mechanism that tells you one of the two silently stopped authenticating.
Start there, then follow the staged rollout.
Lookup costs on this page were measured against live DNS on 2026-08-21 with the checker above, not copied from documentation. Providers do change their records — re-check yours rather than trusting a number in a blog post, including this one.
FAQ
How do I put both Microsoft 365 and Mailchimp in one SPF record?
How many DNS lookups does that use?
Which order should the includes go in?
Related
Still broken after the DNS is right?
Email authentication is DNS. Payment notifications not arriving is usually not — it is a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced. That is what I fix: a fixed-fee $99 root-cause diagnosis, credited toward the repair.