Microsoft 365 DNS Records: MX, SPF, Autodiscover, DKIM and DMARC

Connecting a domain to Microsoft 365 involves a set of DNS records that the admin center generates for your specific tenant. This guide explains what each record is for, what its general shape looks like with example.com placeholders, and how to test it. Two of them, MX and DKIM, contain tenant-specific values that you must copy from Microsoft rather than guess.

Where to edit

Publish the records in whichever DNS zone is authoritative for the domain. If you cannot see changes taking effect, confirm the real nameservers with the Nameserver Lookup. The admin center can add records automatically when DNS is hosted with a supported provider or when you use Microsoft's own nameservers, but a manual setup is entirely normal.

1. Domain verification

To add the domain Microsoft asks for proof of ownership, usually a TXT record:

example.com.   3600  IN  TXT  "MS=ms12345678"

The value is unique to your tenant. Keep it published.

2. MX record

Exchange Online uses a single MX record that points to a tenant-specific hostname:

example.com.   3600  IN  MX  0  example-com.mail.protection.outlook.com.

The target hostname is built from your domain with the dots replaced by hyphens, followed by .mail.protection.outlook.com, and the admin center displays the exact value, which Microsoft's documentation calls the MX token. Copy it from there. Microsoft's guidance is that this record should have the lowest priority number of any MX record, and the admin center usually suggests a value of 0 or 1. Remove MX records from your previous provider, or at least make sure they have a higher number. Better, remove them entirely after cutover.

Verify with the MX Lookup. See MX records explained for priority rules.

3. SPF

example.com.   3600  IN  TXT  "v=spf1 include:spf.protection.outlook.com -all"

Microsoft's documentation uses -all in its example. A softer ~all is a common choice during migrations while you inventory other senders. Rules to remember:

• Exactly one SPF TXT record per domain. Add other senders into the same record.
• The include:spf.protection.outlook.com term uses DNS lookups, and the total across everything you include must not exceed ten. Check with the SPF Record Checker and read fixing too many lookups if you are close.
• Example with an additional sender:

example.com.   3600  IN  TXT  "v=spf1 include:spf.protection.outlook.com include:spf.newsletter.example -all"

4. Autodiscover

Outlook uses Autodiscover to configure itself from a mail address. The standard record is a CNAME:

autodiscover.example.com.   3600  IN  CNAME  autodiscover.outlook.com.

Without it, Outlook clients may prompt for manual server settings or fail to connect. If you run a hybrid environment with an on-premises Exchange server, Autodiscover points elsewhere, so follow the hybrid deployment documentation.

5. DKIM

Microsoft 365 handles DKIM with two CNAME records, which let Microsoft rotate keys for you. You publish the CNAMEs, then turn signing on in Microsoft's security portal.

selector1._domainkey.example.com.   3600  IN  CNAME  selector1-example-com._domainkey.exampletenant.onmicrosoft.com.
selector2._domainkey.example.com.   3600  IN  CNAME  selector2-example-com._domainkey.exampletenant.onmicrosoft.com.

Here exampletenant stands for your tenant's initial onmicrosoft.com domain. The target format has varied; newer tenants may be given a different Microsoft-managed domain, which is one more reason to copy the exact targets from the portal and not rely on a pattern. The portal displays them when you open your domain under the DKIM settings of the email authentication policies.

Steps:

1. Publish both CNAMEs.
2. Wait for DNS to resolve them (dig +short CNAME selector1._domainkey.example.com).
3. In the portal, switch Sign messages for this domain with DKIM signatures to enabled.

The common errors: the DNS host appends your domain to the name, producing a doubled hostname; CNAME flattening or proxying by your DNS provider hides the CNAME; or enabling signing before the records exist. If you see the portal complain that the CNAME record does not exist, query the exact names with the DNS Checker. More diagnostics in DKIM setup and troubleshooting.

6. DMARC

Microsoft does not create this for you. Publish it yourself:

_dmarc.example.com.   3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Then move through quarantine to reject by following the DMARC rollout guide. Remember that Exchange Online will honor the sending domain's DMARC policy on inbound mail it receives too, which is separate from your own record.

7. Other records you may see in the admin center

Depending on your plan and services, the admin center may list additional records. Common ones include:

Add only what the admin center says your services need. Extra records do no good, and incorrect ones can break clients.

Record summary

Verification checklist

1. MX Lookup shows only the Microsoft host (or your gateway).
2. SPF Record Checker shows one record under ten lookups.
3. Email DNS Checker finds DKIM and DMARC.
4. Send a message to the Email Deliverability Test and confirm spf=pass, dkim=pass with header.d=example.com, and dmarc=pass.
5. Open Outlook with a new profile to confirm Autodiscover.

Troubleshooting

• Mail still delivered to the old provider: a leftover MX with a lower number, or caching. See propagation.
• Bounce 550 5.4.1 Recipient address rejected: Access denied: commonly Exchange Online refusing mail for an address that does not exist in the tenant, or a domain set as authoritative that has no matching mailbox. Check the recipient, and read bounce codes explained.
• dkim=fail after enabling: records were not yet resolvable or you are signing with the wrong domain.
• Spam placement though all pass: see email going to spam.

Next steps

• Check the full set with the Email DNS Checker.
• Confirm routing with the MX Lookup.
• Build or revise records with the SPF & DMARC Generator.
• Move to enforcement via the DMARC rollout guide.

FAQ

What is the Microsoft 365 MX token?

It is the tenant-specific part of the MX hostname, shown in the admin center, which normally follows the pattern of your domain with hyphens before .mail.protection.outlook.com. Always copy the value from the admin center.

Why does Microsoft use CNAMEs for DKIM?

The CNAMEs point at keys Microsoft hosts, so Microsoft can rotate the keys without you editing DNS. You still have to publish both selector records and enable signing.

Can I use ~all instead of -all in the SPF record?

Yes, and many administrators do while auditing senders. Microsoft's example uses -all; pick the one you are confident about, and rely on DMARC reports to catch gaps.

Do I need the Autodiscover CNAME if I only use Outlook on the web?

It mainly matters for desktop and mobile clients that configure themselves from the email address. It is cheap to add and recommended by the admin center, so publish it.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.