HOW-TO GUIDE 3

Secure company email with Microsoft Defender for Office 365 Plan 1

1. Purpose

This guide explains how to protect company mailboxes against spoofing, phishing, malicious links and malware attachments. It covers the three email authentication DNS records (SPF, DKIM, DMARC), Microsoft's preset security policies, Safe Links, Safe Attachments, and anti-phishing impersonation protection for key people such as directors and finance staff.

2. Applies to / licence required

3. Prerequisites

• List of every system that sends email using your domain: Microsoft 365, ERP/Tally, payroll, HR portal, marketing or bulk-mail service, scanners/copiers, website forms.
• Login to the DNS hosting for each domain.
• List of VIP users to protect from impersonation (MD, directors, CFO, purchase and accounts heads) and key partner domains (main suppliers, bank).
• A shared mailbox or address to receive DMARC reports (for example dmarc-reports@yourdomain).

4. Step-by-step procedure

Part A – Publish SPF

1. At your DNS provider, find the existing TXT record starting with v=spf1 for the root domain. There must be only one SPF record per domain.
2. If Microsoft 365 is the only sender, use: v=spf1 include:spf.protection.outlook.com -all. Add includes or IP addresses for every other sender, for example v=spf1 include:spf.protection.outlook.com include:<vendor-spf> ip4:<office-public-IP> -all.
3. Keep the record within the 10 DNS-lookup limit. If you are unsure that all senders are listed, start with ~all (soft fail) and move to -all after DMARC reports confirm all legitimate senders pass.

Part B – Enable DKIM signing

4. In the Defender portal go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings (direct link: security.microsoft.com/authentication) and select the DKIM tab.
5. Select your custom domain. If status is NoDKIMKeys, select Create DKIM keys (or try the toggle – the portal will show the required CNAME values).
6. In the domain flyout, copy the two CNAME records (selector1._domainkey and selector2._domainkey) and create them exactly as shown at your DNS provider.
7. After DNS has updated (minutes to a few hours), return to the flyout and turn on Sign messages for this domain with DKIM signatures. Status should change to Signing DKIM signatures for this domain.
8. Repeat for every custom domain that sends email.

[SCREENSHOT PLACEHOLDER – Defender portal – Email authentication settings, DKIM tab with CNAME values]

Part C – Publish DMARC

9. Create a TXT record with host _dmarc (that is, _dmarc.yourdomain) and value: v=DMARC1; p=none; pct=100; rua=mailto:dmarc-reports@yourdomain.
10. Monitor reports for 2–4 weeks (a free or paid DMARC report reader makes the XML reports readable). Fix any legitimate sender that fails SPF or DKIM.
11. Tighten the policy in stages: p=quarantine (optionally with pct=25, then 100), then p=reject when confident.
12. Add DMARC with p=reject for parked domains that never send email.

Part D – Apply preset security policies (Standard or Strict)

13. Go to Email & collaboration > Policies & rules > Threat policies > Preset security policies.
14. Under Standard protection, select Manage protection settings. (Use Strict protection only for high-risk users such as directors and accounts – it quarantines more aggressively.)
15. Apply Exchange Online Protection: choose All recipients, or specific users/groups/domains. Exclude nothing at first except service mailboxes if required.
16. Apply Defender for Office 365 protection: choose the same recipients. This turns on Safe Links, Safe Attachments and Defender anti-phishing for them.
17. Impersonation protection: add VIP users (name and email) to protect, add your own and key partner domains, and add any trusted senders/domains to exclude from impersonation checks.
18. Review the policy-tip and notification settings, then on the review page select Confirm. Make sure the policy toggle shows On.

Note: Preset policies always take priority over custom policies, and their individual settings cannot be edited. Strict applies before Standard. If you need custom settings (for example different quarantine actions), create custom anti-phishing, Safe Links and Safe Attachments policies instead, under Threat policies. The Built-in protection preset gives baseline Safe Links and Safe Attachments to all users who are not covered by another policy.

[SCREENSHOT PLACEHOLDER – Defender portal – Preset security policies page with Standard protection turned on]

Part E – Review Safe Links, Safe Attachments and anti-phishing

19. Go to Threat policies > Safe Links, Safe Attachments and Anti-phishing to confirm the preset policies are listed and apply to the intended users.
20. In Anti-phishing, confirm mailbox intelligence, spoof intelligence and first contact safety tip are on (enabled by the presets).
21. Go to Email & collaboration > Policies & rules > Threat policies > Tenant Allow/Block Lists only when you must block a sender/URL or allow a confirmed false positive. Avoid broad allow entries.
22. Check Settings > Email & collaboration > User reported settings so users can report phishing from Outlook with the built-in Report button.

5. Verification and testing

• Send an email from a company mailbox to an external mailbox (for example a personal Gmail). Open the original message/headers: spf=pass, dkim=pass, dmarc=pass with your domain.
• Send a test email containing an external link to an internal user covered by the preset: in Outlook, hover over the link – it should be rewritten through Safe Links (a *safelinks.protection.outlook.com* address), unless the preset is set not to rewrite.
• Send the harmless EICAR test file from an external mailbox: it should be blocked and appear in Quarantine (security.microsoft.com/quarantine).
• Run Threat policies > Configuration analyzer to compare your settings with Microsoft's Standard and Strict recommendations.
• Ask a pilot user to use Report > Report phishing in Outlook and confirm it appears under Actions & submissions > Submissions.

Ongoing monitoring

• Reports > Email & collaboration > Email & collaboration reports – Threat protection status, Mailflow status, Top senders and recipients.
• Email & collaboration > Real-time detections (Plan 1 version of Explorer) – investigate specific malicious messages.
• Quarantine – review held messages weekly; release only after checking the sender.
• DMARC aggregate reports – review weekly until at p=reject, then monthly.

6. Troubleshooting / common issues

7. Best practices

• Move DMARC to p=reject in stages; never skip the monitoring phase.
• Use Standard protection for all users and Strict for directors, finance and purchase teams.
• Train users to report suspicious mail with the Outlook Report button; review submissions weekly.
• Avoid domain-wide allow entries and mail-flow rules that bypass filtering.
• Document every DNS change with date and reason.

8. Glossary

9. Need help with rollout?

Need help planning or rolling this out across your sites? Contact Kalpesh Adhvaryu (IT consultancy) for rollout support, pilot planning and hands-on configuration.

Portal menus change regularly. This guide was checked against Microsoft Learn documentation in October 2026; if a menu name differs in your tenant, search for the setting name in the portal or check the linked Microsoft Learn topic.