Microsoft 365 DNS Record Generator

1. Domains

Default Microsoft 365 tenant domain

.onmicrosoft.com

Your custom domain

2.1 SPF Learn more

Hard Fail (-all) Soft Fail (~all)

2.2 DMARC Learn more

DMARC Policy

Advanced DMARC settings (optional)

DKIM Alignment (adkim)

SPF Alignment (aspf)

Percentage (pct)

Failure Options (fo)

Report Format (rf)

Report Interval (ri)

DMARC Aggregation (RUA) email address

DMARC Forensics (RUF) email address

2.3 SMTP DANE Learn more

Use the following PowerShell commands to enable DNSSEC and SMTP DANE for your verified domain.

Enable DNSSEC command

Enable SMTP DANE inbound command

2.4 MTA-STS Learn more

Enable MTA-STS DNS record

MTA-STS id date

MTA-STS report email (rua)

SMTP-TLS Learn more

Enable SMTP-TLS / TLS-RPT monitoring record

Monitoring report email address (rua)

Service discovery

Record AVD/W365 Add the Windows 365 / Azure Virtual Desktop feed discovery TXT record. Learn more

Records Intune Add the Enterprise Enrollment and Enterprise Registration CNAME records. Learn more

Your records will appear here after generation.