Free IT Toolbox
Microsoft 365 DNS checker.
Is your domain set up for Microsoft 365? Check the MX, SPF, autodiscover, DKIM and DMARC records against what Microsoft documents for the worldwide commercial service, and see exactly what to fix. This tool sends the domain to our server and public DNS resolvers. No account and no Microsoft sign-in is needed.
What it checks
The records behind a Microsoft 365 setup.
Each result shows what was found, what Microsoft documents, and the exact value to add where Microsoft publishes a fixed one. Microsoft calls some of these records highly recommended rather than required; the checker keeps them separate from the optional Intune pair.
Email delivery (MX and SPF)
The MX record tells senders where your mail goes, and it needs to point at Microsoft 365 first. SPF lists Microsoft 365 as an allowed sender. Microsoft calls SPF highly recommended: without it, your mail is easier to forge and more likely to be treated as junk.
Setup and signing (autodiscover and DKIM)
Autodiscover, also highly recommended, lets Outlook and phones set themselves up. The two DKIM CNAME records prepare email signing; Microsoft treats them as optional during setup and recommends them against forged mail. Microsoft generates their exact values per tenant, so the checker tells you where to copy them instead of guessing.
Forgery policy and devices (DMARC and Intune)
DMARC tells receivers what to do with mail that fails the checks. The two Intune records only matter when you manage devices with Microsoft Intune, so they are optional here.
Some values are specific to your tenant and cannot be worked out from your domain name: the exact MX target and both DKIM CNAME values. For those, the checker points you at the Microsoft 365 admin center and the Defender portal, where Microsoft shows the values to copy. It never invents them.
A green check means the public records match the form Microsoft documents. A tenant-shaped MX or DKIM target is a format match, not proof it is your tenant's exact value, and nothing here proves mail flows, that DKIM signing is turned on, or that the domain belongs to your tenant. For the wider view of your email security, run the Email Security Checker or the Free Technology Checkup.
This checker covers the worldwide commercial Microsoft 365 service. Sovereign clouds use different endpoints. For GCC High, follow Microsoft's GCC High DNS records guide. For DoD or Microsoft 365 operated by 21Vianet, use the instructions Microsoft gives your tenant and cloud instead, never the commercial values here. If your records already point at GCC High endpoints, the checker says so instead of marking them wrong.
See everything in the Free IT Toolbox
Related tools: Email Security Checker, SPF Lookup Analyzer, DMARC Record Generator, SPF Record Generator, Email Header Analyzer, DNS Lookup.
Let’s take a look at your setup.
Book a free assessment. We’ll tell you what’s working, what’s risky and what we’d fix first, even if you never hire us.
Prefer email? support@getwittco.com