Which DNS records does Microsoft 365 need?
For email: an MX record pointing at <token>.mail.protection.outlook.com, an SPF TXT record with include:spf.protection.outlook.com, an autodiscover CNAME to autodiscover.outlook.com, two DKIM CNAMEs (selector1 and selector2) and a DMARC record. Teams federation and Intune enrollment add optional records.
| Record | Name | Value |
|---|---|---|
| MX | @ | contoso-com.mail.protection.outlook.com, priority 0 (newer domains: a name ending in mx.microsoft) |
| TXT (SPF) | @ | v=spf1 include:spf.protection.outlook.com -all |
| CNAME | autodiscover | autodiscover.outlook.com |
| CNAME | selector1._domainkey | selector1-contoso-com._domainkey.<tenant>.onmicrosoft.com |
| CNAME | selector2._domainkey | selector2-contoso-com._domainkey.<tenant>.onmicrosoft.com |
| TXT (DMARC) | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@contoso.com, then quarantine and reject |
| TXT | @ | MS=ms12345678, to verify the domain (may be removed afterwards) |
| SRV (optional) | _sipfederationtls._tcp | 100 1 5061 sipfed.online.lync.com, Teams federation |
| CNAME (optional) | enterpriseenrollment | enterpriseenrollment-s.manage.microsoft.com, Intune |
| CNAME (optional) | enterpriseregistration | enterpriseregistration.windows.net, Entra ID device registration |
The exact MX value and DKIM targets for your tenant are in the Microsoft 365 admin center (Settings, Domains) and the Microsoft Defender portal (Email authentication settings, DKIM).
How the check works
DNS cannot list every name in a domain, so the checker asks the names Microsoft documents: the domain's MX and TXT records, autodiscover, selector1._domainkey and selector2._domainkey, _dmarc, _sipfederationtls._tcp, enterpriseenrollment and enterpriseregistration. It also flags leftovers that cause trouble: an msoid CNAME (only meant for Microsoft 365 operated by 21Vianet) and Skype for Business records Teams no longer uses.
Your browser asks Cloudflare's public resolver directly. Nothing goes through webdave, and the checker never signs in to your Microsoft account, so it sees only what the whole internet sees.
Questions
No. Microsoft's list for Teams-only tenants now has just the _sipfederationtls._tcp SRV record. The lyncdiscover, sip and _sip._tls records came from Skype for Business Online; they do no harm and can be removed.
Microsoft signs with one selector at a time and publishes a key behind the other when it rotates. Both CNAMEs must be in place; one key is enough. If neither has a key, DKIM signing is not switched on yet.
No. With Proofpoint, Mimecast or a similar gateway in front, the MX points at the gateway, which passes mail on to Exchange Online. The checker says so instead of calling it an error.
Usually minutes, at most the old record's TTL (often an hour). Microsoft says up to 72 hours. Check again here: this page keeps answers for at most five minutes.