[ DNS-provider guides ]

Publish SPF DKIM and DMARC records in Azure DNS

Use the authoritative public Azure DNS zone, map full owner names to relative record-set names, preserve TXT boundaries and verify the resulting message authentication.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Verify the active service and authoritative DNS before editing.
  • Preserve record types, owner names and existing authorized services.
  • Verify public answers and actual aligned mail separately.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Verify public answers and actual aligned mail separately.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Preserve names and record boundaries

Relative names, record sets and TXT strings are different concepts.

Next steps

  1. Map full owners to the selected public zone.
  2. Preserve unrelated records in each set.
  3. Compare authoritative answers with issued values.

CISO / SecOps

Keep policy decisions explicit

Publishing a record does not authorize weakening domain protection.

Next steps

  1. Review DMARC changes and report destinations.
  2. Check delegated namespace ownership.
  3. Require actual message alignment before closure.

Founder / Non-technical

Separate hosting from sending

A DNS change can affect several services even when one campaign prompted it.

Next steps

  1. Identify the real sending provider.
  2. Approve the narrow records in scope.
  3. Require a recovery owner before rollout.

[ FAQs ]

Frequently asked questions

Does Azure DNS send or DKIM-sign my email?

No. It publishes the records used by receivers. The actual sending service supplies the authentication configuration and performs signing.

DNS Zones and Records Overview | Microsoft Learn Manage DNS record sets and records with Azure DNS | Microsoft Learn Tutorial: Host your domain in Azure DNS | Microsoft Learn Quickstart: Create a public DNS zone and record - Azure portal - Azure DNS | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Why does a record in my Azure zone not appear publicly?

Check whether the public delegation points to that zone’s assigned nameservers. A zone can exist without being authoritative for the public domain.

DNS Zones and Records Overview | Microsoft Learn Manage DNS record sets and records with Azure DNS | Microsoft Learn Tutorial: Host your domain in Azure DNS | Microsoft Learn Quickstart: Create a public DNS zone and record - Azure portal - Azure DNS | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

What name should I enter for my root-domain DMARC record?

In the public zone for example.com, the relative owner is _dmarc. Confirm the selected zone first; a child zone changes the resulting full name.

DNS Zones and Records Overview | Microsoft Learn Manage DNS record sets and records with Azure DNS | Microsoft Learn Tutorial: Host your domain in Azure DNS | Microsoft Learn Quickstart: Create a public DNS zone and record - Azure portal - Azure DNS | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Should I use the SPF record type?

No. Publish SPF as TXT, retaining one applicable SPF policy at the evaluated owner and preserving unrelated TXT records.

DNS Zones and Records Overview | Microsoft Learn Manage DNS record sets and records with Azure DNS | Microsoft Learn Tutorial: Host your domain in Azure DNS | Microsoft Learn Quickstart: Create a public DNS zone and record - Azure portal - Azure DNS | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

How should I enter a long DKIM TXT value?

Enter the provider’s full value as one logical record. Azure’s portal can segment long strings; do not turn the segments into separate TXT records.

DNS Zones and Records Overview | Microsoft Learn Manage DNS record sets and records with Azure DNS | Microsoft Learn Tutorial: Host your domain in Azure DNS | Microsoft Learn Quickstart: Create a public DNS zone and record - Azure portal - Azure DNS | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Can a DKIM CNAME share an owner with an existing TXT record?

A CNAME cannot coexist with other ordinary record sets at that owner. Resolve the conflict with the service and DNS owners instead of silently deleting existing data.

DNS Zones and Records Overview | Microsoft Learn Manage DNS record sets and records with Azure DNS | Microsoft Learn Tutorial: Host your domain in Azure DNS | Microsoft Learn Quickstart: Create a public DNS zone and record - Azure portal - Azure DNS | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Is a saved record set enough to close the change?

No. Verify authoritative public answers and test a message from the actual sender for authentication and alignment.

DNS Zones and Records Overview | Microsoft Learn Manage DNS record sets and records with Azure DNS | Microsoft Learn Tutorial: Host your domain in Azure DNS | Microsoft Learn Quickstart: Create a public DNS zone and record - Azure portal - Azure DNS | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

What evidence is still missing from this candidate?

An actual Azure walkthrough, authoritative before-and-after queries, an independently checked received message and human SME approval remain required.

DNS Zones and Records Overview | Microsoft Learn Manage DNS record sets and records with Azure DNS | Microsoft Learn Tutorial: Host your domain in Azure DNS | Microsoft Learn Quickstart: Create a public DNS zone and record - Azure portal - Azure DNS | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

[ Sources ]

Sources

  1. DNS Zones and Records Overview | Microsoft Learn

    Sections Record names55–58; CNAME97–103; TXT129–135; Etags

  2. Manage DNS record sets and records with Azure DNS | Microsoft Learn

    Sections Recordsets40–42; edit/apply47–59

  3. Tutorial: Host your domain in Azure DNS | Microsoft Learn

    Sections Retrieve name servers89–95; Delegate96–100

  4. Quickstart: Create a public DNS zone and record - Azure portal - Azure DNS | Microsoft Learn

    Sections Public zone example31–36; Create a DNS record

  5. https://www.rfc-editor.org/rfc/rfc7208.html

    Sections §3.2; 3.3; 4.6.4

  6. https://www.rfc-editor.org/rfc/rfc6376.html

    Sections §3.5; 3.6.2; 6.1

  7. RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

Relative record name
The name entered within an Azure DNS zone without repeating the zone suffix.
Record set
Records of one type at one owner name, managed together in Azure DNS.
TXT character string
One segment inside a logical TXT record, distinct from a separate record.
Authoritative nameserver
A server responsible for providing the DNS zone’s authoritative answers.
TTL
The cache lifetime associated with the DNS record set.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base