Microsoft 365 + Amazon Route 53
Set up Microsoft 365 email on Amazon Route 53
The records Microsoft 365 needs, written with the field names Amazon Route 53 uses (Record name, Value), in the order to add them.
- 6 steps
- 7 DNS records
Before you start
- Have your Microsoft 365 account ready. Some values are unique to your account and come from the Microsoft 365 admin center .
- Open DNS at Amazon Route 53: Open the Route 53 console and select Registered domains, then your domain. Select Manage DNS, then the hosted zone for your domain. If no hosted zone exists, create one first.
- Keep both tabs open and add the records below one at a time.
Records to add
Copy each value with the button next to it. Rows marked “Copy from Microsoft 365 admin center” are unique to your account.
| Record | Type | Record name | Value | Priority | TTL | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| Domain verification Proves you own the domain | Type | TXT | Record name | Leave empty | Value | Copy from Microsoft 365 admin center Looks like: MS=ms followed by digits | Priority | n/a | TTL | 3600 (1 h) |
| MX records Where incoming email goes | Type | MX | Record name | Leave empty | Value | Copy from Microsoft 365 admin center Looks like: <your MX token>.mail.protection.outlook.com, or for domains set up on Microsoft's newer DNSSEC infrastructure <your MX token>.<subdomain>.mx.microsoft | Priority | in the value | TTL | 3600 (1 h) |
| SPF record Which servers may send as you | Type | TXT | Record name | Leave empty | Value | "v=spf1 include:spf.protection.outlook.com -all" | Priority | n/a | TTL | 3600 (1 h) |
| DKIM A signature on every message · recommended | Type | CNAME | Record name | selector1._domainkey | Value | Copy from Microsoft 365 admin center Looks like: selector1-yourdomain-com._domainkey.<your onmicrosoft prefix>.<letter>-v1.dkim.mail.microsoft (older domains: selector1-yourdomain-com._domainkey.<prefix>.onmicrosoft.com) | Priority | n/a | TTL | 3600 (1 h) |
| DKIM A signature on every message · recommended | Type | CNAME | Record name | selector2._domainkey | Value | Copy from Microsoft 365 admin center Looks like: selector2-yourdomain-com._domainkey.<your onmicrosoft prefix>.<letter>-v1.dkim.mail.microsoft (older domains: selector2-yourdomain-com._domainkey.<prefix>.onmicrosoft.com) | Priority | n/a | TTL | 3600 (1 h) |
| DMARC record What to do with fakes · recommended | Type | TXT | Record name | _dmarc | Value | "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com" | Priority | n/a | TTL | Default |
| Autodiscover Automatic app setup · recommended | Type | CNAME | Record name | autodiscover | Value | autodiscover.outlook.com | Priority | n/a | TTL | 3600 (1 h) |
Step by step in Amazon Route 53
Verify your domain
Your email provider needs proof that you control this domain before it accepts email for it.
- Type
- TXT
- Record name
- Leave this field empty
- Value
- Copy it from Microsoft 365 admin center (see below)
Where to find your value
In the Microsoft 365 admin center go to Settings > Domains and add your domain (or select it and choose Start setup). On Verify you own your domain, choose Add a TXT record to the domain's DNS records and copy the TXT value.
It looks like: MS=ms followed by digits
- Verification usually takes up to 10 minutes after adding the record, sometimes up to 48 hours.
1 more note from Microsoft 365 on this record
In Amazon Route 53
- Select Create record.
- Enter the Record name (leave it empty for your bare domain) and choose TXT.
- In Value, enter the text inside double quotes. If you already have a TXT record on that name, add the new value as another line in the same record.
- Select Create records.
Point your MX records
MX records tell other mail servers where to deliver your email. How MX works
- Type
- MX
- Record name
- Leave this field empty
- Value
- Copy it from Microsoft 365 admin center (see below)
Where to find your value
In the Microsoft 365 admin center go to Settings > Domains, select your domain, then DNS records > Manage DNS. On the Add DNS records page, expand MX Records and copy the value.
It looks like: <your MX token>.mail.protection.outlook.com, or for domains set up on Microsoft's newer DNSSEC infrastructure <your MX token>.<subdomain>.mx.microsoft
- Remove MX records that point to your previous email provider, or give them a lower priority (a higher number) than the Microsoft 365 record.
- Add users and mailboxes in Microsoft 365 before switching the MX record so incoming mail keeps flowing.
2 more notes from Microsoft 365 on this record
In Amazon Route 53
- In the hosted zone, select Create record.
- Leave Record name empty, choose MX as Record type, and keep Simple routing.
- In Value, enter the priority, a space, then the mail server (for example 10 mail.example.com). Put each mail server on its own line in the same record.
- Select Create records, then delete any older MX records.
Add the SPF record
SPF lists the services allowed to send email as you. How SPF works
- Type
- TXT
- Record name
- Leave this field empty
- Value
-
"v=spf1 include:spf.protection.outlook.com -all"
- If an SPF record already exists, don't create a second one. Add include:spf.protection.outlook.com to the existing record so there is a single SPF record.
2 more notes from Microsoft 365 on this record
In Amazon Route 53
- Select Create record.
- Enter the Record name (leave it empty for your bare domain) and choose TXT.
- In Value, enter the text inside double quotes. If you already have a TXT record on that name, add the new value as another line in the same record.
- Select Create records.
Set up DKIM (recommended)
DKIM signs your mail so receivers can trust it. How DKIM works
- Type
- CNAME
- Record name
-
selector1._domainkey - Value
- Copy it from Microsoft 365 admin center (see below)
Where to find your value
In the Microsoft Defender portal open Email authentication settings (security.microsoft.com/authentication), select the DKIM tab and your domain, then copy the two CNAME values. They are also shown in the admin center under Add DNS records > Advanced options > DomainKeys Identified Mail (DKIM).
It looks like: selector1-yourdomain-com._domainkey.<your onmicrosoft prefix>.<letter>-v1.dkim.mail.microsoft (older domains: selector1-yourdomain-com._domainkey.<prefix>.onmicrosoft.com)
- After both CNAME records resolve, turn on Sign messages for this domain with DKIM signatures in the Defender portal.
- Type
- CNAME
- Record name
-
selector2._domainkey - Value
- Copy it from Microsoft 365 admin center (see below)
Where to find your value
Same place as selector1: Defender portal > Email authentication settings > DKIM tab > your domain.
It looks like: selector2-yourdomain-com._domainkey.<your onmicrosoft prefix>.<letter>-v1.dkim.mail.microsoft (older domains: selector2-yourdomain-com._domainkey.<prefix>.onmicrosoft.com)
- Add both selector records. Microsoft rotates between them.
1 more note from Microsoft 365 on this record
In Amazon Route 53
- Select Create record.
- Enter the Record name (for example autodiscover) and choose CNAME.
- Enter the target in Value.
- Select Create records.
- Repeat for each CNAME record above.
Add the DMARC record (recommended)
DMARC tells receivers what to do with mail that fakes your domain. How DMARC works
- Type
- TXT
- Record name
-
_dmarc - Value
-
"v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"
- Replace the report address with a shared mailbox or group, not a personal inbox.
3 more notes from Microsoft 365 on this record
In Amazon Route 53
- Select Create record.
- Enter the Record name (leave it empty for your bare domain) and choose TXT.
- In Value, enter the text inside double quotes. If you already have a TXT record on that name, add the new value as another line in the same record.
- Select Create records.
Add the Autodiscover record (recommended)
Autodiscover lets Outlook and other mail apps find your account settings without manual setup.
- Type
- CNAME
- Record name
-
autodiscover - Value
-
autodiscover.outlook.com
- Optional but highly recommended: lets Outlook and other apps set up mailboxes automatically.
In Amazon Route 53
- Select Create record.
- Enter the Record name (for example autodiscover) and choose CNAME.
- Enter the target in Value.
- Select Create records.
Check your setup
Once the records are saved, run a live check. We look up your domain in public DNS and tell you what is right, missing or wrong, with the fix in Amazon Route 53’s words.
Common mistakes with Microsoft 365 on Amazon Route 53
Switching MX before adding mailboxes
Add users and mailboxes in Microsoft 365 before changing the MX record, or incoming mail has nowhere to go.
Adding a second SPF record
Microsoft says not to create a new SPF record if one exists. Add include:spf.protection.outlook.com to the existing record so there is a single SPF record.
Amazon Route 53: One TXT record per name
With simple routing, Route 53 keeps all TXT values for a name in the same record, one value per line. Add SPF next to a verification value instead of creating a second TXT record.
Amazon Route 53: Split long TXT values
A single quoted string can hold up to 255 characters. Split longer values, such as DKIM keys, into quoted pieces on one line: "part one" "part two".
Microsoft 365 on Amazon Route 53: questions
Where do I add Microsoft 365 DNS records in Amazon Route 53?
Open the Route 53 console and select Registered domains, then your domain. Select Manage DNS, then the hosted zone for your domain. If no hosted zone exists, create one first. Add each record there, one at a time.
What goes in the Record name field at Amazon Route 53?
Leave it empty for records on your bare domain, such as MX and SPF. For the others, enter only the part before your domain, for example autodiscover. Amazon Route 53 adds your domain automatically.
Do I need to delete my existing MX records at Amazon Route 53?
Remove MX records that point to your previous email provider, or give them a lower priority (a higher number) than the Microsoft 365 record.
How long until Microsoft 365 email works on Amazon Route 53?
DNS changes typically take about 15 minutes to take effect, occasionally longer.
Sources
Every value and step on this page comes from these official pages. Dashboards change, so if something doesn’t match what you see, tell us.
Microsoft 365 records
- Add a custom domain to Microsoft 365 (Microsoft Learn)
- Connect DNS records at Namecheap to Microsoft 365 (Microsoft Learn)
- Connect your DNS records at GoDaddy to Microsoft 365 (Microsoft Learn)
- Connect your domain by adding DNS records (Microsoft Learn)
- External Domain Name System records for Microsoft 365 (Microsoft Learn)
- How SMTP DANE works (Microsoft Learn)
- How to use DKIM for email in your custom domain (Microsoft Learn)
- RFC 9989: DMARC (IETF)
- Set up DMARC to validate email in Microsoft 365 (Microsoft Learn)
- Set up SPF to identify valid email sources for your Microsoft 365 domain (Microsoft Learn)
Amazon Route 53 steps and tips
Some of these are other email providers' official guides for Amazon Route 53. They describe the same Amazon Route 53 dashboard.
Microsoft 365 on other hosts
- Microsoft 365 on Bluehost
- Microsoft 365 on Cloudflare
- Microsoft 365 on GoDaddy
- Microsoft 365 on Hostinger
- Microsoft 365 on Namecheap
- Microsoft 365 on Squarespace Domains
- Microsoft 365 on DreamHost
- Microsoft 365 on IONOS
- Microsoft 365 on Name.com
- Microsoft 365 on Network Solutions
- Microsoft 365 on OVHcloud
- Microsoft 365 on Porkbun
- Microsoft 365 on SiteGround
- Microsoft 365 on Wix
- Microsoft 365 on WordPress.com
Other email providers on Amazon Route 53
- Fastmail on Amazon Route 53
- Google Workspace on Amazon Route 53
- Hostinger Email on Amazon Route 53
- iCloud+ Custom Email Domain on Amazon Route 53
- Migadu on Amazon Route 53
- Namecheap Private Email on Amazon Route 53
- Proton Mail on Amazon Route 53
- Rackspace Email on Amazon Route 53
- Titan Email on Amazon Route 53
- Zoho Mail on Amazon Route 53