Microsoft 365 + SendGrid SPF with MailAuth Doctor
The builder opens with Microsoft 365 and SendGrid ticked, shows the merged record and the lookup cost of the pair, and warns when you approach the limit.
- Keep both services ticked and add your other senders.
- Pick ~all while testing, or -all when sure.
- Copy the single merged record and replace your existing SPF TXT record.
- Check the live domain to confirm lookups and syntax.
What to know
The merged record is v=spf1 include:spf.protection.outlook.com include:sendgrid.net ~all. Microsoft 365 documents include:spf.protection.outlook.com and SendGrid documents include:sendgrid.net; each must live in the same single TXT record on your domain.
Measured on 2026-10-10, Microsoft 365 costs one lookup and SendGrid two, so the pair uses three of ten. SendGrid's record contains a nested include, which is what the extra lookup is. If you add several providers with nested includes the total grows quickly, which is the usual way SPF ends up over the limit.
SendGrid's domain authentication (a CNAME-based setup) can handle SPF for a subdomain, which keeps its include out of your main domain's record. If your main record is close to the limit, that is the cleaner design.
Updated · Cosmovex
Questions
What is the SPF record for Microsoft 365 and SendGrid?
v=spf1 include:spf.protection.outlook.com include:sendgrid.net ~all, published as a single TXT record.
How many lookups do Microsoft 365 and SendGrid use?
Three in total on 2026-10-10: one for Microsoft 365 and two for SendGrid. Providers can change this, so verify.
Do I replace my old record or add a second one?
Replace it with the merged record. Two SPF records cause a permanent error.
Can I keep SendGrid out of my main SPF record?
Yes, by authenticating a dedicated sending subdomain with SendGrid so that its SPF is published there instead.
The free plan covers everything on this page. MailAuth Doctor Pro ($7/mo, billed monthly) is described on the MailAuth Doctor page.
