How to Check Microsoft 365 DNS
A practical guide to checking Microsoft 365 DNS records, including MX, autodiscover, SPF, DKIM, DMARC, and the signs of an incomplete migration.
Tools For This Topic
Start by checking whether the domain really looks like Microsoft 365
Microsoft 365 leaves distinctive DNS patterns, but the cleanest way to judge the setup is to compare several record types together. MX, autodiscover, SPF, DKIM, and DMARC all add useful evidence.
This is especially helpful during migrations, audits, or when you need to confirm whether Microsoft 365 is the live provider rather than only one part of a mixed environment.
Check the MX and autodiscover records
The MX hostname often shows Exchange Online Protection directly, and autodiscover usually points to Outlook service endpoints. Together, these are strong signals that Microsoft 365 is handling core mail functions.
If old MX records or broken autodiscover targets are still present, the domain may be only partly migrated.
Review SPF, DKIM, and DMARC together
A domain can route mail through Microsoft 365 and still have weak or incomplete authentication. Check whether SPF includes Microsoft 365, whether the DKIM selectors resolve and signing is active, and whether DMARC is published.
Looking at these together makes it easier to tell whether the environment is clean or only mostly migrated.
Look for signs of an incomplete Microsoft 365 migration
- Legacy MX records still sit alongside Microsoft 365
- SPF still authorises an old provider without a clear reason
- Autodiscover is missing or points somewhere unexpected
- DKIM is published but not enabled, or still points to old selectors
These are the sorts of problems that often explain why a domain looks partly correct in DNS but still behaves inconsistently in production.
A practical Microsoft 365 DNS check workflow
- Check MX and autodiscover to confirm Microsoft 365 patterns
- Review SPF, DKIM, and DMARC together
- Look for old providers or stale migration leftovers
- Inspect a real message header if mail is failing or being filtered
- Compare the observed setup with the intended Microsoft 365 design
Use These DNS Pro Tools
If you want to validate this topic in practice, these DNS Pro tools are the fastest next step.
Related Tools
Related Articles
How to Check Google Workspace DNS
A practical guide to checking Google Workspace DNS records, including MX, SPF, DKIM, DMARC, and the signs of a mixed or incomplete setup.
DNS Records Required for Microsoft 365 (Complete Setup Guide)
Complete guide to Microsoft 365 DNS records including MX, SPF, CNAME, DKIM, and DMARC. Includes real record examples and migration best practices.
How to Check Email Security for a Domain
A practical workflow for checking email security for a domain, including SPF, DMARC, DKIM, MX, MTA-STS, TLS-RPT, BIMI, and provider setup.
