Email provider

Microsoft 365 DNS records

Outlook and Exchange Online email for your own domain, managed from the Microsoft 365 admin center. Covers the worldwide service only (not GCC or 21Vianet).

Visit Microsoft 365 Open Microsoft 365 admin center

Where is your domain's DNS managed?

Each guide below uses that host's field names, steps and known problems.

The records Microsoft 365 needs

These are the values for any DNS host. Field names differ between hosts, so use the host guides above for the exact boxes to fill in.

Domain verification Proves you own the domain Type TXT Host / Name @ Value Copy from Microsoft 365 admin center Looks like: MS=ms followed by digits Priority n/a TTL 3600 (1 h)
MX records Where incoming email goes Type MX Host / Name @ Value Copy from Microsoft 365 admin center Looks like: <your MX token>.mail.protection.outlook.com, or for domains set up on Microsoft's newer DNSSEC infrastructure <your MX token>.<subdomain>.mx.microsoft Priority 0 TTL 3600 (1 h)
SPF record Which servers may send as you Type TXT Host / Name @ Value v=spf1 include:spf.protection.outlook.com -all Priority n/a TTL 3600 (1 h)
DKIM A signature on every message · recommended Type CNAME Host / Name selector1._domainkey Value Copy from Microsoft 365 admin center Looks like: selector1-yourdomain-com._domainkey.<your onmicrosoft prefix>.<letter>-v1.dkim.mail.microsoft (older domains: selector1-yourdomain-com._domainkey.<prefix>.onmicrosoft.com) Priority n/a TTL 3600 (1 h)
DKIM A signature on every message · recommended Type CNAME Host / Name selector2._domainkey Value Copy from Microsoft 365 admin center Looks like: selector2-yourdomain-com._domainkey.<your onmicrosoft prefix>.<letter>-v1.dkim.mail.microsoft (older domains: selector2-yourdomain-com._domainkey.<prefix>.onmicrosoft.com) Priority n/a TTL 3600 (1 h)
DMARC record What to do with fakes · recommended Type TXT Host / Name _dmarc Value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Priority n/a TTL Default
Autodiscover Automatic app setup · recommended Type CNAME Host / Name autodiscover Value autodiscover.outlook.com Priority n/a TTL 3600 (1 h)

Notes on each record

What Microsoft 365's documentation says about each record, in one place.

VERIFICATION Domain verification

  • Verification usually takes up to 10 minutes after adding the record, sometimes up to 48 hours.
  • This record only proves you own the domain. It doesn't affect anything else and can be deleted after verification.

MX MX records

  • Remove MX records that point to your previous email provider, or give them a lower priority (a higher number) than the Microsoft 365 record.
  • Add users and mailboxes in Microsoft 365 before switching the MX record so incoming mail keeps flowing.
  • Use the highest priority your host allows, typically 0.
  • Exchange Online only supports TTL values under 6 hours (21,600 seconds).

SPF SPF record

  • If an SPF record already exists, don't create a second one. Add include:spf.protection.outlook.com to the existing record so there is a single SPF record.
  • Microsoft recommends -all (hard fail) together with DKIM and DMARC.
  • Only one SPF record is allowed per domain, and it must stay under 10 DNS lookups.

DKIM DKIM

  • After both CNAME records resolve, turn on Sign messages for this domain with DKIM signatures in the Defender portal.
  • Microsoft lists DKIM as optional, but DMARC needs DKIM to align with your domain.
  • Add both selector records. Microsoft rotates between them.

DMARC DMARC record

  • Replace the report address with a shared mailbox or group, not a personal inbox.
  • Start with p=none and read the reports, then move to p=quarantine and finally p=reject. Microsoft's example also has pct=100; the current DMARC standard (RFC 9989) dropped pct, and 100 was the default anyway, so it's left out here.
  • Set up SPF and DKIM first.
  • Microsoft 365 doesn't send forensic (ruf) reports.

AUTODISCOVER Autodiscover

  • Optional but highly recommended: lets Outlook and other apps set up mailboxes automatically.

Common Microsoft 365 mistakes

Switching MX before adding mailboxes

Add users and mailboxes in Microsoft 365 before changing the MX record, or incoming mail has nowhere to go.

Adding a second SPF record

Microsoft says not to create a new SPF record if one exists. Add include:spf.protection.outlook.com to the existing record so there is a single SPF record.

Publishing DKIM CNAMEs but not turning on signing

After both selector CNAMEs resolve, switch on Sign messages for this domain with DKIM signatures in the Defender portal.

Using a TTL longer than 6 hours on MX

Exchange Online only supports TTL values under 6 hours (21,600 seconds). One hour (3600) is the recommended value.

Check your Microsoft 365 DNS

Enter your domain to see which records are in place.

We only read public DNS records. Nothing is stored.

Sources