Microsoft 365 setup check
Type your domain to see how its public records line up with Microsoft's setup, and what to fix. This reads public DNS only, so it can't tell you whether your Microsoft 365 is secure. We show you what it can't see too.
Results
What DNS can't see
The settings that protect your accounts live inside your Microsoft 365 tenant, your company's Microsoft 365 account. They never appear in public DNS, so no outside check can read them. A clean result above says nothing about these six. Sign in to your admin center and answer them yourself.
Your answers stay on this page. They aren't saved or sent anywhere.
Where to look: Microsoft Entra admin center: Entra ID > Overview > Properties > Manage security defaults. If those are off, look in Entra ID > Conditional Access > Policies for a policy that requires MFA for all users. Security defaults make every user register and ask for MFA when Microsoft judges it necessary, and every time for admin roles.
Why it matters
A password alone isn't enough to protect an account, and DNS can't tell you whether anyone has more than that.
CISA: phishing-resistant MFA shall be enforced for all users (MS.AAD.3.1v1), and MFA shall be enforced for all users (MS.AAD.3.2v2).
Where to look: Microsoft Entra admin center: Entra ID > Conditional Access > Policies, and Entra ID > Overview > Properties > Manage security defaults.
Why it matters
Use one or the other. Security defaults need no extra license. Conditional Access needs at least Microsoft Entra ID P1.
From Microsoft's security defaults guidance. CISA says numerous policies in its Entra ID baseline rely on Conditional Access.
Where to look: Microsoft 365 admin center: Role assignments > Global Administrator > Assigned.
Why it matters
Microsoft says to have as few as possible, and its security defaults guide says to use separate accounts for admin work and everyday work. Answer no if anyone reads email on a Global Administrator account.
CISA: a minimum of two and a maximum of eight (MS.AAD.7.1v1), on cloud-only accounts (MS.AAD.7.3v1).
Where to look: Security defaults block it. Otherwise, look for a blocking policy in Entra ID > Conditional Access > Policies. To see who still uses it, open Entra ID > Monitoring & health > Sign-in logs and filter by Client App.
Why it matters
Older mail protocols like IMAP, POP3 and SMTP don't support MFA, so they can get around it. Check copiers and scanners that send email before you block it.
CISA: legacy authentication shall be blocked (MS.AAD.1.1v1).
Where to look: Microsoft Defender portal: Email & collaboration > Policies & rules > Threat policies > Anti-spam > your outbound policy > Automatic forwarding rules.
Why it matters
A compromised account can use an inbox rule to forward mail out. Microsoft advises choosing On or Off here, not Automatic, because Automatic behaves differently between organizations.
CISA: automatic forwarding to external domains shall be disabled (MS.EXO.1.1v2).
Where to look: Microsoft Purview portal: Audit. A banner asking you to start recording activity means it's off.
Why it matters
Microsoft says auditing isn't on by default for Microsoft 365 Business Basic, Standard and Premium. Without it, you may have no record to review after a break-in.
CISA: unified audit logging shall be enabled (MS.SECURITYSUITE.5.1v1).
0 of 6 answered.
Go further than public records
Two tools that cost nothing extra read the settings inside your tenant. Both need someone with admin access to sign in, which is why this page can't do what they do.
Microsoft Secure Score sits in the Microsoft Defender portal at security.microsoft.com/securescore and lists recommended actions. Microsoft is clear that a high score isn't a guarantee against a breach. Read Microsoft's guide.
ScubaGear is a free PowerShell tool from CISA, the US cybersecurity agency. It compares your tenant's settings with CISA's SCuBA baselines. CISA wrote those baselines for federal agencies, and they're for information only for everyone else, so treat them as a strict reference and not as a rule your business must meet. See ScubaGear on GitHub or read CISA's Entra ID baseline.
Microsoft also has its own domain check, called Check health, in the admin center. See how to use it. If you're trying to install Word or Excel, use Microsoft's setup troubleshooter.
For an A to F grade on SPF, DKIM and DMARC, use our email security check.
If you'd rather have someone handle this, our Microsoft 365 managed services cover tenant security and daily admin. Our guide to Microsoft 365 security settings goes through the settings in more depth.
What each record does
Sources last checked November 2, 2026.
MX
MX tells other mail systems where to deliver your email. For Microsoft 365 it normally ends in mail.protection.outlook.com or mx.microsoft. Microsoft says to remove MX records that point to your old system once mail is flowing to Exchange Online, and that one MX record avoids many delivery problems.
SPF
SPF lists who may send email for your domain. A domain can have only one SPF record, and it can't need more than 10 DNS lookups. Most Microsoft 365 organizations need include:spf.protection.outlook.com in it.
DKIM
DKIM puts a signature on your outgoing mail. For a custom domain, Microsoft uses two CNAME records named selector1 and selector2. Microsoft says it doesn't sign mail with your custom domain until you set this up. DNS shows that the records exist, not that signing is on.
DMARC
DMARC tells receivers what to do with email that fails SPF and DKIM. p=none asks receivers to take no action. You get reports only if the record lists a rua address. p=quarantine and p=reject are the settings that act on fake email.
Autodiscover
This CNAME record helps Outlook find the right server and set itself up. Microsoft's value for most tenants is autodiscover.outlook.com. Microsoft tells hybrid Exchange customers to point it at their on-premises servers instead.
msoid
Most domains shouldn't have this record. Microsoft documents it only for Microsoft 365 operated by 21Vianet. Anywhere else, it can stop people activating their licenses, and generic DNS tools won't tell you why.
MTA-STS and TLS reporting
MTA-STS tells other servers to use encrypted, verified connections when they deliver to you. It needs a DNS record and a policy file on your web server. We read only the DNS record, and we show these as extra information.
DNSSEC and DANE
These protect the DNS answers and the mail connection itself. Microsoft offers inbound DANE through dedicated hosts under mx.microsoft and has no plans to sign mail.protection.outlook.com. Moving MX records is sensitive, so we show this for information and give it no grade.
Microsoft: modernizing DNS security for Exchange Online (April 2026)
Questions about the setup check
If this comes back clean, is my Microsoft 365 secure?
No. A clean result means the public DNS records we read look right, and nothing more. MFA, Conditional Access, admin accounts, legacy sign-in, forwarding rules and audit logs live inside your tenant, and no outside check can read them.
Does this send my domain to GlobeVM?
No. The check runs in your browser and asks public DNS services (Cloudflare, with Google as a backup) for the records, so the domain you type isn't sent to or stored by GlobeVM. Cloudflare or Google may keep short-term logs under their own policies, including your IP address. They also ask your domain's name servers, and Microsoft's when your records point to Microsoft, as they would for any lookup. GlobeVM's web host sees that you opened this page, as on any page, but not what you typed. We never connect to your mail server or website, and the domain doesn't go in the page address.
Can I check a domain that isn't mine?
Yes, the same as any DNS lookup tool. DNS records are public by design. The check reads only those records. It doesn't sign in or test accounts. It doesn't show who works at a company or a domain's tenant name.
We use Mimecast or Proofpoint. Why doesn't it show Microsoft as our mail route?
Your MX record points to the gateway, so that's what public DNS shows. If your SPF, Autodiscover or DKIM records point to Microsoft, the check treats the gateway as sitting in front of Microsoft 365. What happens after the gateway isn't visible from DNS.
What is the msoid record, and why would it stop licenses activating?
msoid is a CNAME record that Microsoft documents only for Microsoft 365 operated by 21Vianet in China. Microsoft says that on any other service, people on your domain get a "custom domain isn't in our system" error and can't activate their licenses. If you see this fault, delete the record unless your tenant is operated by 21Vianet.
How is this different from your email security check?
The email security check grades SPF, DKIM and DMARC from A to F, for any email provider. This one looks only at what is specific to Microsoft 365: mail routing, old MX records, Microsoft's DKIM selectors, Autodiscover and msoid. It lists SPF and DMARC briefly because they affect the same setup.
Does Microsoft have its own domain check?
Yes. In the Microsoft 365 admin center, go to Setup > Domains. If the Status column shows an issue, select the three dots next to the domain and choose Check health. It needs an admin sign-in, and it shows the records to fix.
What doesn't this check cover?
It covers mail and sign-in records in public DNS. It doesn't test your domain verification TXT record, the Teams SRV record or Intune records. If you're trying to install Word or Excel, use Microsoft's setup troubleshooter instead.
Want us to check the rest?
Get a free IT assessment. We look at your setup, including Microsoft 365, and give you a plain-English list of what to fix first. No cost and no obligation.
Microsoft and Microsoft 365 are trademarks of Microsoft Corporation. This free check is made by GlobeVM and isn't made or endorsed by Microsoft.