Microsoft 365 Custom Domain DNS and Name Server Configuration Guide
Completing your Microsoft 365 name server setup involves pointing your custom domain's DNS records or authoritative name servers to Microsoft or keeping them at your current registrar while adding specific records. To ensure your configuration is accurate and propagating correctly, you can use the NS Lookup tool to query your domain's live DNS records across global name servers instantly.
Setting up a custom domain in Microsoft 365 connects your professional email addresses (such as user@example.com) and collaboration tools directly to your organization. Whether you choose to manage all DNS records via Microsoft or maintain your current domain registrar, understanding the exact record types, values, and verification processes is essential for uninterrupted business operations.
Understanding Microsoft 365 Domain Options
When you integrate a custom domain into Microsoft 365, you have two primary methods for handling your DNS architecture. Your choice impacts how you manage future updates for web hosting, security policies, and mail flow.
1. Complete DNS Management (Custom Name Servers)
With this method, you change your domain registrar's name servers to point directly to Microsoft's Azure DNS name servers (typically ending in ns1-38.azure-dns.com, etc.). Microsoft automatically manages all your DNS records, including MX, CNAME, and TXT entries. This is the easiest option for organizations that do not host a separate website on their domain.
2. Partial DNS Management (Keep Existing DNS Host)
With this method, your domain remains with your current registrar, Cloudflare, GoDaddy, or AWS Route 53, and you manually add specific Microsoft 365 DNS records to your existing zone file. This is the preferred method if your domain already hosts a corporate website or complex internal services that must remain on your current hosting infrastructure.
Step-by-Step Microsoft 365 Name Server Setup
Follow these steps to connect your custom domain to Microsoft 365 using partial DNS management, which is the most common approach for businesses.
Step 1: Add the Domain in Microsoft 365 Admin Center
- Sign in to the Microsoft 365 admin center using your global administrator credentials.
- Navigate to the left-hand menu path: Show all > Settings > Domains.
- Click Add domain.
- Enter your custom domain name (e.g.,
example.com) and click Use this domain.
Step 2: Verify Domain Ownership
Microsoft requires proof that you own the domain before routing traffic or emails through their servers.
- Select Add a TXT record to the domain's DNS records (recommended) and click Continue.
- Microsoft will display a unique TXT value looking similar to
MS=ms12345678. - Log in to your domain registrar's management console.
- Create a new TXT record with the following parameters:
| Field | Value | Notes |
|---|---|---|
| Type | TXT | Select TXT from the record type dropdown |
| Host / Name | @ or leave blank |
Refers to your root domain example.com |
| Value / Text | MS=ms12345678 |
Provided by your Microsoft 365 admin center |
| TTL | 3600 seconds (or 1 hour) | Standard caching time |
- Return to the Microsoft 365 admin center and click Verify. Verification may take anywhere from a few minutes to a few hours depending on global DNS propagation.
Step 3: Configure Exchange Online (MX Record for Email)
To receive emails via Exchange Online, update your MX record so mail servers know where to deliver incoming messages for example.com.
- In your registrar's DNS management panel, locate your existing MX records and note them down as a backup.
- Add a new MX record with these settings:
Type: MX
Host: @
Points to address: example-com.mail.protection.outlook.com
Priority: 0 (or lowest available number)
TTL: 3600
Note: Replace example-com with your actual domain name, substituting hyphens for dots (e.g., example-com.mail.protection.outlook.com).-
Step 4: Configure SPF, DKIM, and DMARC (Email Security)
To prevent spoofing and ensure your outgoing emails do not land in spam folders, you must configure authentication records.
Sender Policy Framework (SPF):
Add or update your root TXT record to include Microsoft's mail servers. If you already have an SPF record, append include:spf.protection.outlook.com into the existing string.
Type: TXT
Host: @
Value: v=spf1 include:spf.protection.outlook.com ~all
Autodiscover (CNAME Record): Outlook uses Autodiscover to automatically configure desktop and mobile email clients.
Type: CNAME
Host: autodiscover
Points to: autodiscover.outlook.com
TTL: 3600
Validating Your Setup via Command Line
Before finalizing your setup in the Microsoft portal, test your records using command-line diagnostic tools. Open your terminal or PowerShell prompt.
To check your MX record using PowerShell or Linux terminal:
nslookup -type=mx example.com
Sample expected output:
Server: 192.0.2.1
Address: 192.0.2.1#53
example.com MX preference = 0, mail exchanger = example-com.mail.protection.outlook.com
To check your domain verification TXT record:
nslookup -type=txt example.com
Common Mistakes and How to Fix Them
- Conflicting MX Records: Leaving old MX records active alongside your Microsoft MX record causes split mail delivery, where some emails disappear or fail to deliver. Delete all non-Microsoft MX records.
- Incorrect SPF Record Syntax: Having more than one SPF record breaks email authentication. Combine multiple include statements into a single TXT record.
- TTL Delays: Making changes and testing immediately often leads to false negatives. High TTL values set by previous providers delay propagation. Wait up to 24 hours for full global propagation.
Quick Checklist for Microsoft 365 Setup
- Domain added in Microsoft 365 Admin Center
- TXT verification record added and verified
- MX record updated to point to Exchange Online Protection
- SPF TXT record configured with
spf.protection.outlook.com - Autodiscover CNAME record created
- Live mail flow successfully tested by sending an external email