spf authorization
Domains with Microsoft 365 sender authorization
Observed Microsoft 365 sender authorization DNS evidence across 598 domains in the selected Domain Signals .com and .org watchlist. Baselines, changes and limitations.
domains with latest confirmed evidence
- First observations
- 598
- New appearances
- 0
- Returns
- 0
- Confirmed disappearances
- 0
Observed window: 2026-10-02T01:10:08+00:00 to 2026-10-02T02:33:06+00:00
Selected watchlist · events cover retained history · baselines excluded from new appearances
What the observation means
An SPF include authorizes the named service to send email for a domain. Authorization can remain unused and does not prove an active product installation.
Reading the history
A baseline is the first confirmed observation for a domain. It is kept separate from later changes and is never counted as a new adoption.
A new appearance is a matching DNS feature that was absent in a previous successful observation. A return means a previously observed feature reappeared after a confirmed absence. Neither gives the exact time a company installed a product.
A confirmed disappearance requires the configured number of successful absence confirmations on separate observation days. Resolver timeouts and other transient errors preserve the previous confirmed state.
Scope and limitations
Counts describe a selected, bounded watchlist in .com and .org. They are not a census of .com and .org, a market-share estimate, or a list of companies verified to use a product. Event counts cover all retained observation history and can contain repeated changes for the same domain.
The public site shares aggregate research; domain-level records remain in the private dashboard. Source access and downstream use are governed by the applicable registry and CZDS terms.
Read the collection methodology for coverage, evidence types and error handling.