Microsoft 365 MX Records: Complete Setup Guide

Microsoft 365 (formerly Office 365) handles email for millions of businesses. Unlike Google Workspace with its five standard MX records, Microsoft uses a single MX record that's unique to your organization. This guide shows you how to find your specific values and configure them correctly.

Microsoft 365 MX Record Format

Microsoft 365 MX records follow this pattern:

yourdomain-com.mail.protection.outlook.com

Your domain name is embedded in the hostname, with dots replaced by hyphens. For example:

• Domain: example.com → MX: example-com.mail.protection.outlook.com
• Domain: my-company.com → MX: my-company-com.mail.protection.outlook.com
• Domain: subdomain.example.com → MX: subdomain-example-com.mail.protection.outlook.com

The priority is typically 0 (highest priority, tried first).

Finding Your Exact MX Record

While you can construct the MX record from the pattern above, Microsoft provides the exact values in your admin portal:

1. Sign into the Microsoft 365 admin center (admin.microsoft.com)
2. Go to Settings → Domains
3. Select your domain
4. Click DNS records or Manage DNS
5. Find the MX record entry with exact values

Microsoft shows you the complete record including priority, hostname, and any additional settings specific to your tenant.

Standard Microsoft 365 MX Configuration

For most organizations, the MX record looks like this:

That's it—just one MX record. Microsoft handles redundancy internally through their infrastructure. You don't need multiple MX records like Google Workspace.

Adding Microsoft 365 MX Records

The process varies by DNS provider. Here's the general approach:

Step 1: Remove Old MX Records

If migrating from another email provider:

1. Delete existing MX records from your DNS
2. Don't leave old records—they cause mail routing conflicts

Step 2: Add the Microsoft MX Record

In your DNS provider's interface:

• Type: MX
• Host/Name: @ (or blank for root domain)
• Value/Points to: yourdomain-com.mail.protection.outlook.com
• Priority: 0
• TTL: Default (usually 1 hour)

Step 3: Verify in Microsoft Admin

After DNS propagation:

1. Return to Microsoft 365 admin center
2. Go to Settings → Domains
3. Microsoft will verify the MX record automatically
4. Look for a green checkmark confirming correct setup

Why Only One MX Record?

Google uses five MX records. Why does Microsoft use one?

Microsoft handles redundancy differently. The single hostname (mail.protection.outlook.com) actually points to a highly redundant, globally distributed infrastructure. Microsoft manages failover internally rather than exposing multiple MX entries.

Benefits of this approach:

• Simpler DNS configuration
• Fewer records to manage
• Less chance of misconfiguration
• Microsoft handles load balancing automatically

The downside: you can't configure your own backup MX servers. But for most organizations, Microsoft's built-in redundancy is more than sufficient.

Microsoft 365 With Security Gateways

Some organizations route email through a security gateway (Mimecast, Proofpoint, Barracuda) before Microsoft 365. In this case:

MX records point to the gateway, not Microsoft:

yourdomain-com.mail.protection.proofpoint.com

The gateway scans email, then forwards clean messages to Microsoft 365. Your Microsoft 365 configuration accepts email from the gateway's IP addresses.

If you use a security gateway, follow their documentation for MX setup rather than pointing directly to Microsoft.

Hybrid Exchange Configurations

Organizations running hybrid Exchange (on-premises Exchange with Microsoft 365) have more complex MX requirements:

Centralized mail flow: MX points to on-premises servers, which route to Microsoft 365 as needed.

Cloud-first: MX points to Microsoft 365, which routes to on-premises for specific mailboxes.

Split configuration: Some domains point to cloud, others to on-premises.

Hybrid configurations require careful planning. Consult Microsoft's hybrid deployment documentation or work with a Microsoft partner for these setups.

Common Microsoft 365 MX Issues

"MX Record Not Found" in Admin Portal

• DNS changes haven't propagated yet (wait 15-60 minutes)
• Typo in the MX hostname
• Record added to wrong DNS zone
• Using custom nameservers that weren't updated

Email Delivering to Old Provider

• Old MX records still exist alongside Microsoft's
• DNS propagation incomplete
• Solution: Remove old MX records and wait for propagation

"Domain Verification Failed"

MX record verification is separate from domain verification. Make sure you've:

1. Added the TXT verification record first
2. Completed domain verification
3. Then added MX records

Emails Bouncing with "Relay Denied"

The domain isn't properly configured as an accepted domain in Microsoft 365:

1. Go to Mail flow → Accepted domains
2. Verify your domain is listed
3. Check the domain type (Authoritative vs Internal Relay)

Additional DNS Records for Microsoft 365

MX records route incoming email. You'll also need:

SPF Record (TXT)

v=spf1 include:spf.protection.outlook.com -all

Check at spfrecordcheck.com.

DKIM Records (CNAME) Microsoft uses two CNAME records for DKIM:

• selector1._domainkey → selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com
• selector2._domainkey → selector2-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

Find exact values in the Microsoft 365 admin portal. Test at dkimtest.com.

DMARC Record (TXT)

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

Check at dmarcrecordchecker.com.

Autodiscover (CNAME) Helps Outlook clients configure automatically:

autodiscover → autodiscover.outlook.com

Migrating to Microsoft 365

When moving from another email provider:

Before Migration

1. Lower existing MX record TTL to 300-600 seconds (24-48 hours before)
2. Set up Microsoft 365 tenant and add domain
3. Create user mailboxes
4. Migrate existing email using Microsoft's migration tools

During Migration

1. Remove old MX records
2. Add Microsoft 365 MX record
3. Keep old email system running temporarily

After Migration

1. Verify email flows correctly to Microsoft 365
2. Monitor for delivery issues
3. Decommission old email system after 48-72 hours
4. Increase TTL back to normal

Monitor Your MX Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.