Exchange Online Protection Settings: Recommended Anti-Phishing, Anti-Spam and SPF, DKIM, DMARC Setup

The short version: The quickest safe setup is to turn on the Standard preset security policy for all users and Strict for your high-risk accounts, then publish SPF, DKIM and DMARC for every sending domain. Only a few settings sit outside the presets, mainly outbound spam limits and automatic forwarding. Finish by running the Configuration analyzer, which lists every policy setting that is weaker than Standard or Strict.

This guide is for the admin of a Microsoft 365 tenant who wants to know which Exchange Online Protection (EOP) settings to use and how to apply them. Microsoft now calls EOP the "built-in security features for all cloud mailboxes", so you will see that name in current Learn pages. All values below were checked against Microsoft Learn on 28 October 2026.

What EOP covers

The built-in protections are on by default for every cloud mailbox: anti-malware, inbound and outbound anti-spam, connection filtering, and anti-phishing (spoofing) protection, with zero-hour auto purge removing bad mail after delivery. You cannot turn the default threat policies off, but you can override them with preset or custom policies. Impersonation protection, phishing email thresholds, Safe Links and Safe Attachments need Microsoft Defender for Office 365 (see Defender for Office 365 Plan 1 vs Plan 2).

Fix SPF, DKIM and DMARC first or alongside this. Microsoft warns that if they are missing or wrong, legitimate mail can land in Junk or quarantine even with the recommended policy settings.

Step 1: turn on the preset security policies

1. Open the Microsoft Defender portal at security.microsoft.com.
2. Go to Email & collaboration > Policies & rules > Threat policies > Preset Security Policies (in the Templated policies section).
3. On your first visit, Standard protection and Strict protection are normally off. Slide Standard protection to On, select Manage protection settings to start the wizard, and on the Apply Exchange Online Protection page select All recipients.
4. Optional: turn on Strict protection and assign it to a small group such as executives, finance and IT admins. Microsoft applies Strict first, then Standard, then default and custom policies.

Permissions: membership in the Organization Management or Security Administrator role group. Read-only access works for Global Reader.

Preset policy settings are mostly not editable. If you need different values, use custom policies and copy the recommended values below.

Step 2: recommended values if you build custom policies

Values are in the order default, Standard, Strict. They come from Microsoft's recommended settings page.

Anti-spam policy

• Bulk email threshold: 7, 6, 5.
• Spam action: Move to Junk Email folder, Move to Junk Email folder, Quarantine.
• High confidence spam action: Move to Junk Email folder, Quarantine, Quarantine.
• Phishing action: Move to Junk Email folder (default policy), Quarantine, Quarantine.
• High confidence phishing action: Quarantine in all three. Users cannot release their own high confidence phishing messages.
• Bulk complaint level met or exceeded action: Move to Junk Email folder, Move to Junk Email folder, Quarantine.
• Retain spam in quarantine: 15 days, 30 days, 30 days.
• Zero-hour auto purge for spam and phishing: on in all three.

Anti-malware policy

• Common attachments filter: on in all three.
• When these file types are found: Reject the message with a non-delivery report in all three.
• Zero-hour auto purge for malware: on in all three.
• Quarantine policy: AdminOnlyAccessPolicy in all three.

Anti-phishing policy (spoofing, for all mailboxes)

• Enable spoof intelligence: on in all three.
• Honor DMARC record policy: on in all three. Quarantine when the sender's DMARC policy is p=quarantine, reject when it is p=reject.
• If the message is detected as spoof by spoof intelligence: Move to Junk Email folder, Move to Junk Email folder, Quarantine.
• Show first contact safety tip: off by default, on for Standard and Strict.
• Show (?) for unauthenticated senders and Show "via" tag: on in all three.

Outbound spam policy (not part of the presets)

• External message limit per hour: 500 recommended for Standard, 400 for Strict.
• Internal message limit per hour: 1000 for Standard, 800 for Strict.
• Daily message limit: 1000 for Standard, 800 for Strict.
• Restriction for users who reach the limit: Restrict the user from sending mail.
• Automatic forwarding rules: Off - Forwarding is disabled. The default is system-controlled.

Step 3: SPF, DKIM and DMARC

You publish these at your DNS host. Microsoft 365 has no portal for SPF or DMARC records.

SPF

Create one TXT record at the root of each sending domain. If Microsoft 365 is your only sender:

v=spf1 include:spf.protection.outlook.com -all

Rules from Microsoft: only one SPF record per domain or subdomain, fewer than 10 DNS lookups, TTL of at least 3600 seconds. Each subdomain that sends mail needs its own SPF record. For domains that never send mail, publish v=spf1 -all.

DKIM

1. In the Defender portal go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings and open the DKIM tab.
2. Select your custom domain to see the two CNAME values to publish, or read them with PowerShell:

Connect-ExchangeOnline
Get-DkimSigningConfig -Identity contoso.com | Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME
# If the domain has no config yet:
New-DkimSigningConfig -DomainName contoso.com -Enabled $false

1. At your DNS host, create CNAME records for selector1._domainkey and selector2._domainkey pointing to the values shown. Use the values from your tenant, not an example.
2. Once DNS has propagated, enable signing: open the domain's details flyout on the DKIM tab and switch on Sign messages for this domain with DKIM signatures. The status shows CnameMissing until Microsoft detects your CNAME records, which can take a few minutes or longer. Or run Set-DkimSigningConfig -Identity contoso.com -Enabled $true.

DMARC

Roll out in stages, as Microsoft recommends. Hostname _dmarc, record type TXT:

1. Start with v=DMARC1; p=none; pct=100; rua=mailto:dmarc-reports@contoso.com and read the aggregate reports.
2. Move to p=quarantine, raising pct through 10, 25, 50, 75, 100.
3. Move to p=reject when reports show your legitimate senders pass.

Send reports to a shared mailbox or group, not one person's inbox. Use a subdomain for third-party senders you do not control.

Step 4: check with the Configuration analyzer

Go to Email & collaboration > Policies & rules > Threat policies > Configuration analyzer, or open security.microsoft.com/configurationAnalyzer. The Standard recommendations tab shows every setting weaker than Standard. The Strict recommendations tab does the same for Strict. Select a row to read the reason and, where available, Apply recommendation. The Configuration drift analysis and history tab shows changes for up to 90 days and needs unified auditing turned on.

To read back key values from PowerShell:

Get-HostedContentFilterPolicy | Format-List Name,BulkThreshold,SpamAction,HighConfidenceSpamAction,PhishSpamAction,QuarantineRetentionPeriod
Get-MalwareFilterPolicy | Format-List Name,EnableFileFilter,FileTypeAction,ZapEnabled
Get-AntiPhishPolicy | Format-List Name,HonorDmarcPolicy,DmarcQuarantineAction,DmarcRejectAction

Common mistakes

1. Editing the default policies and forgetting the presets override them. If a user is in a preset, your custom policy does not apply to them.
2. Publishing two SPF records. Two records for one domain cause a permanent error. Merge them into one.
3. Going straight to p=reject for DMARC. Start at p=none, read the reports and add missing senders first.
4. Ending SPF with ~all and expecting DMARC to act. Microsoft recommends -all so DMARC can act on messages that fail SPF and also lack DKIM.
5. Leaving outbound limits and forwarding at defaults. They are outside the presets. Set them by hand.
6. Copying DKIM CNAME targets from an example. Always copy the values shown in your own tenant.

How to check it worked

1. On the Preset security policies page, confirm Standard shows as on and lists the intended recipients.
2. Microsoft's own test: a spam (not high confidence) message goes to Junk for Standard users and to quarantine for Strict users.
3. Microsoft's own test for bulk mail: a message with BCL 6 or higher goes to Junk for Standard users, and BCL 5 or higher is quarantined for Strict users.
4. Send a message to an external mailbox, open the headers and check for spf=pass, dkim=pass and dmarc=pass.
5. Re-run the Configuration analyzer and confirm the count of items needing attention is falling.
6. Review the DMARC aggregate reports weekly while you tighten the policy.

FAQ

What does "this message is protected with Microsoft information protection" mean?

The sender used Microsoft Purview Message Encryption or rights protection on the message. Recipients must authenticate to read it, and the sender may have blocked actions such as forwarding. See how to send and open an encrypted email in Outlook.

Is Exchange Online Protection included in Microsoft 365?

Microsoft says the built-in protections are included in all organisations with cloud mailboxes. A separate built-in security subscription also exists for on-premises mailboxes. For current prices, check Microsoft's pricing pages.

What is the difference between EOP and Defender for Office 365?

EOP covers anti-spam, anti-malware, anti-phishing for spoofing, connection filtering and ZAP. Defender for Office 365 adds Safe Links, Safe Attachments, impersonation protection and phishing email thresholds, and Plan 2 adds investigation and simulation tools.

What should my anti-phishing policy settings be?

Turn on spoof intelligence and Honor DMARC record policy, quarantine on p=quarantine, reject on p=reject, and show first contact safety tips. The simplest route is to assign the Standard preset policy to everyone.

What does Exchange Online Protection do in Microsoft 365?

It is the set of built-in protections for every cloud mailbox: anti-spam, anti-malware, anti-phishing for spoofing, connection filtering and zero-hour auto purge. Microsoft now calls it the built-in security features for all cloud mailboxes. To audit your own settings, use the Configuration analyzer described above.

See also the Microsoft 365 security checklist and Microsoft Secure Score vs CIS Benchmark vs SCuBAGear.

If you want a second pair of eyes on your tenant configuration, our Microsoft 365 security audit reviews these settings.

If you would rather know the price of a full review before you start, what a Microsoft 365 security audit costs sets out the fixed prices by headcount.