Microsoft 365 (Exchange Online) receives mail for 1,173 of 9,971 popular domains we measured in November 2026. Below: the records it needs and how its customers actually set them.
| Host | Priority |
|---|---|
<domain-with-dashes>.mail.protection.outlook.com | 0 |
The MX host is derived from your domain (dots replaced by dashes). Tenants that enabled the newer DNSSEC-capable inbound endpoint get a host under mx.microsoft instead.
Add include:spf.protection.outlook.com to the domain's single SPF record, for example:
v=spf1 include:spf.protection.outlook.com -all922 of 1173 Microsoft 365 (Exchange Online) customers in our sample (78.6%) have this include in their SPF record.
Two CNAME records, selector1._domainkey and selector2._domainkey, pointing to the targets shown in the Microsoft Defender portal for your tenant.
Publish a TXT record at _dmarc.<domain> once SPF and DKIM pass for all mail you send, start with p=none and a reporting address, then move to p=quarantine or p=reject:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@<domain>Official documentation: MX · SPF · DKIM · DMARC
Provider site: https://www.microsoft.com/microsoft-365/exchange/email
1,173 customer domains in the sample (accent bars) compared with all 9,971 measured domains (grey bars).
The highest-ranked domains in the sample whose MX records point to Microsoft 365 (Exchange Online).
Check one yourself:
Customer-specific parts replaced by <domain> and digits by <n>.
| MX host pattern | Domains |
|---|---|
<domain>.mail.protection.outlook.com | 1090 |
adobe.mail.protection.outlook.com | 8 |
<domain>.olc.protection.outlook.com | 4 |
wolterskluwer.mail.protection.outlook.com | 3 |
sponaeop.mail.protection.outlook.com | 2 |
<domain>.u-v<n>.mx.microsoft | 2 |
<domain>.i-v<n>.mx.microsoft | 2 |
microsoft-com.mail.protection.outlook.com | 2 |
Source: our own scan of November 2026 (2026-11-11), 9,971 of the top 10,000 domains of the Tranco list Y895G that answered in DNS. Method and data.