MX Records for Microsoft 365

Microsoft 365 MX Records

To route email through Microsoft 365 (Exchange Online), you need a single MX record pointing to Microsoft's mail protection service. The hostname follows a specific pattern based on your domain.

Required MX Record

example.com.    3600    IN    MX    0 example-com.mail.protection.outlook.com.

The hostname format is your domain name with dots replaced by hyphens, followed by .mail.protection.outlook.com. For the domain example.com, this becomes example-com.mail.protection.outlook.com.

How the Hostname Is Determined

Microsoft generates the MX hostname based on your verified domain in the Microsoft 365 Admin Center. The pattern is predictable:

Your Domain	MX Target
example.com	example-com.mail.protection.outlook.com
my-company.co.uk	my-company-co-uk.mail.protection.outlook.com
sub.domain.org	sub-domain-org.mail.protection.outlook.com

You can always verify the exact hostname in the Microsoft 365 Admin Center under Settings > Domains.

Priority Value

Microsoft recommends a priority of 0 for their MX record. If your DNS provider does not support 0, use 1 as the lowest available value. There is typically only one MX record for Microsoft 365, unlike Google Workspace which uses multiple servers.

Complementary DNS Records

A complete Microsoft 365 email setup requires additional records:

; SPF record
example.com.    3600    IN    TXT    "v=spf1 include:spf.protection.outlook.com -all"

; Autodiscover CNAME (for Outlook client autoconfiguration)
autodiscover.example.com.    3600    IN    CNAME    autodiscover.outlook.com.

DKIM records are configured through the Microsoft 365 Defender portal and use CNAME records pointing to Microsoft's DKIM signing infrastructure.

Exchange Online Protection (EOP)

The mail.protection.outlook.com hostname resolves to Microsoft's Exchange Online Protection servers. These servers perform anti-spam, anti-malware, and policy filtering before delivering messages to your mailboxes. This is an included feature of all Microsoft 365 plans that include email.

Migration Steps

1. Lower existing MX TTL values to 300 seconds 24-48 hours before the switch
2. Verify your domain in the Microsoft 365 Admin Center
3. Add the new MX record
4. Add the SPF TXT record and Autodiscover CNAME
5. Remove old MX records after verifying delivery works
6. Configure DKIM signing in the Defender portal

Troubleshooting

If email delivery fails after adding the MX record, verify the hostname format matches exactly. A common error is using dots instead of hyphens in the domain portion of the hostname.