Microsoft 365 email DNS checker
Check the public DNS records that matter when Microsoft 365 custom-domain email is not receiving, sending, verifying, or authenticating correctly.
Microsoft 365 setup can involve both public DNS records and provider-admin steps. Domain Email Doctor checks the public DNS side only.
Microsoft 365 email setup depends on public DNS plus tenant-specific instructions from the Microsoft admin center.
Use this page to check the DNS pieces without guessing Microsoft 365 verification, MX, DKIM, or autodiscover values.
DNS records to check first
| Record | What to check | Safe note |
|---|---|---|
| MX | Confirm the domain has the Microsoft 365 MX target shown in the admin center for this tenant. | Do not invent Microsoft 365 MX, verification, or DKIM values. Microsoft MX targets are domain and tenant specific. |
| SPF | If Microsoft 365 sends mail for the domain, SPF commonly includes spf.protection.outlook.com. | Merge Microsoft with any other real senders in one SPF record; do not publish duplicate SPF records. |
| DKIM | Microsoft 365 custom-domain DKIM commonly uses selector1 and selector2 CNAME records generated by Microsoft. | Publish the exact CNAME targets from Microsoft 365 or Microsoft Defender. Do not copy targets from another tenant. |
| DMARC | Add DMARC after SPF and DKIM are understood so receiver policy matches the domain's real senders. | Avoid moving directly to p=reject until Microsoft 365 and any third-party senders are passing authentication. |
| Autodiscover | If Outlook setup is failing, check whether Microsoft asks for an autodiscover CNAME record. | Use the exact Microsoft 365 admin value and keep email-related CNAME records DNS-only when using Cloudflare. |
Common mistakes
- Using a generic Microsoft MX value instead of the tenant-specific value shown in the admin center.
- Forgetting selector1 and selector2 DKIM CNAME records.
- Keeping old Google Workspace or web-host MX records when Microsoft 365 should receive mail.
- Publishing duplicate SPF records while trying to add Microsoft 365.
Boundaries
Domain Email Doctor checks public DNS records and does not access a Microsoft tenant.
Mailbox creation, shared mailboxes, licenses, aliases, and mail flow rules remain inside Microsoft 365.
Tenant-specific MX, DKIM, verification, and autodiscover values must come from Microsoft.
Related guides
Next step: Run one public DNS scan before changing Microsoft 365 custom-domain records.
Run an email DNS check