If you use Microsoft 365 for email but host your website with CanSpace, you need to point your domain's DNS records at Microsoft's mail servers. This article walks through what to add.
admin.microsoft.com). Microsoft's setup wizard will give you a tenant-specific MX hostname and a CNAME for Autodiscover — use the exact values from your tenant, because they're unique to you.Where to add the records
Add DNS records in the place that manages your domain's DNS:
- Nameservers at CanSpace (dns1/dns2, domain-only clients) — use Manage DNS Records: How do I manage DNS entries?
- Hosting with CanSpace — use cPanel's Zone Editor (Domains section)
- Nameservers elsewhere — add records at that provider
DNS records to add
1. MX record (tenant-specific)
Microsoft generates a unique MX hostname based on your domain. It's your domain with the dots replaced by hyphens, followed by .mail.protection.outlook.com. For example:
example.ca→example-ca.mail.protection.outlook.commy.company.com→my-company-com.mail.protection.outlook.com
The exact value is also shown in the Microsoft 365 admin center under Settings → Domains → DNS records.
| Type | Name | Priority | Value |
|---|---|---|---|
| MX | @ (or your bare domain) |
0 | {yourdomain-with-dashes}.mail.protection.outlook.com |
Delete any other MX records previously pointing at mail.yourdomain.com or similar. Only the Microsoft MX should remain.
2. SPF record
| Type | Name | Value |
|---|---|---|
| TXT | @ (or your bare domain) |
v=spf1 include:spf.protection.outlook.com -all |
-all (hard fail). If you also send mail through our hosting, soften to ~all and add our IP: v=spf1 +a +mx include:spf.protection.outlook.com ~all.3. Autodiscover CNAME
Autodiscover lets Outlook auto-configure itself when users enter their email address. Strongly recommended.
| Type | Name | Value |
|---|---|---|
| CNAME | autodiscover |
autodiscover.outlook.com |
4. DKIM record
Microsoft provides two DKIM CNAMEs (selectors) you need to publish. Find them in the Microsoft 365 admin center under Security → Email authentication settings → DKIM → Enable. They look like this (with your unique tenant values):
| Type | Name | Value |
|---|---|---|
| CNAME | selector1._domainkey |
selector1-yourdomain-com._domainkey.{tenant}.onmicrosoft.com |
| CNAME | selector2._domainkey |
selector2-yourdomain-com._domainkey.{tenant}.onmicrosoft.com |
Copy the exact values Microsoft shows in your admin center — they're tenant-specific.
5. DMARC record (recommended)
| Type | Name | Value |
|---|---|---|
| TXT | _dmarc |
v=DMARC1; p=none; rua=mailto:[email protected] |
Replace [email protected] with an address you'll check — weekly DMARC reports come to this address.
If you host your website with us too
Open a support ticket and ask us to set email routing to automatic for your domain. Without this, our mail server will keep delivering mail locally instead of handing it off to Microsoft.
Keep any verification records
When you first added your domain to Microsoft 365, you added a MS=ms... TXT record. Keep it — Microsoft re-checks it periodically.
Skype for Business and Teams (optional)
Microsoft also recommends a few SRV and CNAME records for Teams federation and Skype. These are optional — your email will work fine without them. If your organization uses Teams external federation, check the admin center's DNS records page for the full list.
Testing
- Allow 1-2 hours for DNS propagation.
- Send yourself a test email from an outside address to
[email protected]. It should land in your Microsoft 365 inbox. - Send a test from Microsoft 365 out to a Gmail address. Check the headers for
spf=pass,dkim=pass, anddmarc=pass.
Related articles
Still stuck? Open a support ticket
