Keep your Microsoft Online Email Routing Address secure with Red Sift OnDMARC

Every Microsoft 365 tenant includes a default domain in the format tenantname.onmicrosoft.com. This is known as the Microsoft Online Email Routing Address (MOERA).

What many don’t realize is that attackers have started using these domains to impersonate organizations in phishing attacks. If left unmonitored, MOERA domains can become a blind spot in your email security.

DMARC: Your best line of defense

The good news is you can stay protected thanks to Domain-based Message Authentication, Reporting & Conformance (DMARC). DMARC is an essential email security measure for protecting your outbound communications, and that includes protecting your default Microsoft domain (onmicrosoft.com). Failure to act could leave your domain unprotected, leading to spoofing attempts. 

For existing customers, we recommend that you add this domain to your OnDMARC account and create a DMARC record for it just like you would for your other domains. Microsoft will take care of SPF and DKIM for you and you can then add your OnDMARC reporting address into the DMARC record. 

Please note

Due to the way this domain is hosted at Microsoft, you will not be able to use Dynamic Services, but you can still set up a manual DMARC record.

For instructions on how to modify the DNS records of your MOERA domain, refer to Microsoft’s instructions here and use the same DMARC record you entered in any of the other domains in your Red Sift OnDMARC account. We also recommend setting it to an enforcement policy of quarantine or reject

Have any questions? Raise a ticket with our support team.

Not a Red Sift OnDMARC user? Start your 14-day free trial today.

PUBLISHED BY

Faisal Misle

26 Mar. 2025

SHARE ARTICLE:

Categories

Recent Posts

VIEW ALL
News

Red Sift now offered through GuidePoint Security in new partnership

Rahul Powar

Organizations seeking to elevate their cybersecurity posture can now benefit from Red Sift’s advanced innovations, supported by GuidePoint Security’s expertise in aligning the right solutions to each customer’s needs. BOSTON & LONDON, 08:00 ET/ 13:00 BST, 10 September 2025 – Red Sift today announced a strategic reseller partnership with GuidePoint Security, the leading U.S.…

Read more
Awards

From Europe to Asia Pacific: OnDMARC earns global recognition in G2’s Fall…

Francesca Rünger-Field

G2’s Fall 2025 Report is out, and Red Sift OnDMARC continues to earn recognition across the globe. This quarter, we were featured in 19 reports, including a new appearance in the Asia Pacific Regional Grid® Report for DMARC, reinforcing our position as a trusted solution for securing email and protecting brands worldwide. We also…

Read more
AI

AI supercharges airline phishing: Why email security must catch up

Rahul Powar

Executive summary: Only 1 in 5 airlines enforces DMARC at the highest level, leaving customers exposed to phishing attacks that are now supercharged by AI. With billions at stake and national security on the line, airlines must move fast by adopting strong email authentication, deploying AI to counter AI, and leading by example across…

Read more
DMARC

74% of US credit unions vulnerable to email spoofing: Is your organization…

Stuart Rogers

Email remains a heavy lifter for credit unions, whether it’s member notices, statements, loan workflows, or vendor coordination. That’s exactly why impersonation keeps paying, with the National Credit Union Association (NCUA) warning that all credit unions and vendors are active targets for phishing and social engineering, and urges rapid incident reporting when attacks hit.…

Read more