Microsoft 365 / How to Add a Company Domain and Verify DNS Settings

To connect a company domain to Microsoft 365, you must first verify domain ownership and then configure the Domain Name System (DNS) records according to the services you will use. TXT (text) records for ownership verification and MX (mail exchanger) records for routing incoming mail to Microsoft 365 serve different purposes. If you are using existing mail, prepare user mailboxes and a migration plan before changing MX records.

What to prepare before you start

• Authorized access to your domain registrar and the provider that actually hosts your DNS records
• List of DNS records currently in use for your website, mail, and external sending services
• User addresses to be used in Microsoft 365 and the status of mailbox preparation
• Mail cutover date and time, person in charge, test address, criteria for reverting if a problem occurs

The domain registrar and DNS hosting provider may be different. If you add a record on the wrong management screen, it will not be verified. Microsoft's guide to adding a custom domain explains both Domain Connect automatic setup and manual DNS setup.

In Microsoft 365, use an account with permission to add a domain, such as one assigned the Domain Name Administrator role. Permissions for the DNS provider account and Microsoft 365 administrator permissions are separate, so you need access to both. Even if you are logged in to the provider where the domain was purchased, if the nameservers point to a different provider, the actual DNS modification must be done at that provider.

Before starting work, export the current records or keep them as a list. You need to record the type, name, value, priority, and TTL together to be able to restore them. TTL (Time To Live) is the time a DNS response is kept in cache. Just because it is saved on the DNS screen does not mean all external users will immediately query the new value.

Verify domain ownership

1. In the Microsoft 365 admin center, go to Settings → Domains and select Add domain. If the menu is collapsed, press Show all.

2. Enter the domain you want to add and select the provided ownership verification method. If you manage DNS manually, copy the host and value of the TXT record displayed on the screen exactly. The values provided by Microsoft differ for each domain, so do not use the example values as they are.
3. Add the corresponding TXT record through your DNS hosting provider. If there is already another TXT record for the same host, do not delete or overwrite it blindly; check if you can add it as a separate record.

4. Return to the admin center and press Verify. Even if it fails immediately, it may be due to DNS propagation delay, so first check the input values and DNS management location, then try again after a short while.

Understanding the DNS input fields

The values in the table below are for input method explanation purposes. Do not create actual TXT verification values or MX targets using them; you must copy the values provided by the admin center for the corresponding domain.

If the ownership verification fails, first check whether the TXT record for that name can be retrieved from the DNS that actually has authority. There may be ownership verification TXT records from other services at the same name, and this should not be resolved by deleting them. An error stating that the domain is already in use by another tenant is a different issue from DNS propagation. Check the existing tenant association and the organization that owns the domain first.

Connecting DNS for email and other services

Completing ownership verification does not automatically complete email migration. The Microsoft 365 setup wizard presents the records required for the services you select. MX records used for email, CNAME records used for client auto-configuration, and SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) records for sender domain authentication each have different roles. Check the tenant screen for the necessary records and values. The DNS connection procedure of Microsoft also guides through this sequence.

1. Before migration, confirm all users and shared addresses receiving email on the domain, and prepare Microsoft 365 mailboxes.
2. Review the service-specific records displayed in the setup wizard. If you have an existing sending system, do not create multiple SPF records and check whether it can be integrated with the current configuration.
3. Set the timing for the mail switch and change the MX record. From this point, new mail can start coming into Microsoft 365, so a transition plan with the existing mail server is necessary.
4. Check the domain status and DNS query results in the admin center, and send and receive test emails both inside and outside the organization. Do not only check mail delivery but also verify the sender authentication results.

What to verify before and after the mail cutover

For example, if you are migrating 20 employees and 2 main addresses, checking only the employee accounts is not sufficient. Create a list of all recipient addresses, aliases, and shared mailboxes, and ensure that Microsoft 365 is ready to receive mail for those addresses. Moving past emails from the existing server is separate from changing the MX record. Changing the MX alone does not automatically copy the contents of previous mailboxes.

1. Just before the switch: Compare the existing MX and website records, the prepared recipient list, and the scheduled task time. Even if using automatic settings, read the records that will be changed on the approval screen and confirm whether the existing mail path will be altered.
2. Immediately after the switch: Verify in DNS queries that the MX destination and priority match the plan, and rerun the domain check in the admin center. Even if the DNS check passes, it does not mean that all user mailboxes have been tested.
3. Mail Test: Send emails from external addresses to both employee and representative addresses, and reply externally using Microsoft 365 as well. Record the test time and recipient addresses, and keep any delivery failure notifications.
4. Stability Check: Check if new emails remain on the previous server. Sending systems that still have cached DNS information may continue using the old route for a while, so do not remove the previous environment immediately.

For emails that did not arrive, check the route using message trace, and investigate sender authentication with sender authentication checks. Do not finalize the mail migration simply based on the result that ownership verification was successful.

Will the website also be moved to Microsoft 365?

No. Adding a domain to Microsoft 365 does not automatically move the existing website. However, changing DNS records incorrectly can disrupt the website or other services. If only switching mail, do not unnecessarily modify the website’s A (IPv4 address), AAAA (IPv6 address), or CNAME (alias) records.

If a problem occurs, first compare the current DNS records with the records before the change. Even if you revert the MX to the previous value, the transition may not match immediately due to DNS caching, so check the reception status of both mail environments together. When restoring, only revert the records changed this time to their previous values, and compare which side received mail during the transition. DNS recovery does not merge the data of the two mailboxes. Also, avoid methods such as deleting the domain or users to temporarily suspend the service connection.