Microsoft 365 DNS Checklist for Reliable Business Email

Start with the records Microsoft provides for your tenant

Microsoft 365 domain setup can generate different values depending on the tenant and domain. Use the records shown in the Microsoft admin center instead of copying values from another company or tutorial.

The MX record controls where inbound mail is delivered. Changing it is a real mail-flow cutover, so confirm mailbox readiness before making the switch.

Verify SPF without creating duplicates

Microsoft 365 commonly needs an SPF include for Microsoft protection infrastructure, but your domain may also send through a CRM, website, help desk or marketing platform. Combine legitimate sources into one SPF policy rather than publishing multiple SPF records.

Remove old providers only after you are certain nothing still sends through them. Printers, websites and line-of-business applications are easy to overlook.

Enable DKIM for the custom domain

DKIM signing for a custom domain requires the correct selector records and must also be enabled in Microsoft 365. Publishing DNS alone does not guarantee that outbound messages are being signed.

After enabling DKIM, send a message externally and inspect the raw header to verify that the DKIM signature uses your domain and validates successfully.

Add and monitor DMARC

DMARC helps protect the visible From domain from spoofing and gives you a way to monitor authentication alignment. Start with a policy that matches your readiness and increase enforcement after legitimate systems are aligned.

If other platforms send as your domain, make sure their SPF or DKIM authentication aligns before moving to a stricter policy.

Check Autodiscover and client configuration

Autodiscover records help compatible Outlook clients locate Microsoft 365 services. During migrations, stale DNS or cached profiles can cause confusing client behavior even when mail flow itself is correct.

Document the old and new records, lower TTLs before the planned cutover where appropriate, and avoid deleting legacy records until the migration is verified.

Test after the DNS change

Send inbound and outbound messages, test external recipients, inspect authentication headers and verify aliases and shared mailboxes. Also test any systems that relay through Microsoft 365, including websites and applications.

A successful login to Outlook is not the same as a successful end-to-end mail migration.