Microsoft 365 bundles Outlook mail, Teams, OneDrive and Office apps under one account. For mail to work on addresses like name@company.uz, you add the domain to Microsoft 365 and configure several DNS records. There are a few more than with other providers: separate records handle ownership, receiving mail, client auto-configuration and message signing.
Adding the domain and verifying it
Sign in to the Microsoft 365 admin center as a global administrator, open Settings, then Domains, and click Add domain. Automatic setup may be offered for some registrars, but adding records manually is always possible. If the domain is registered through sayt.uz and uses our nameservers, add the records in the domain's DNS section of the cabinet. Microsoft first gives a TXT value starting with MS=ms followed by digits for the root domain. It affects nothing else; add it as a separate TXT record rather than merging it with SPF, then click verify.
Core mail records
After verification the admin center lists the Exchange Online records. The MX value is built from your domain, usually with dots replaced by hyphens plus mail.protection.outlook.com, so example.uz becomes example-uz.mail.protection.outlook.com. Microsoft has been updating the MX format for new domains, so copy the exact value from the admin center.
| Type | Name | Value | Purpose |
|---|---|---|---|
| TXT | @ | MS=ms12345678 | Ownership |
| MX | @ | example-uz.mail.protection.outlook.com (priority 0) | Receiving mail |
| CNAME | autodiscover | autodiscover.outlook.com | Outlook auto-configuration |
| TXT | @ | v=spf1 include:spf.protection.outlook.com -all | Allowed senders (SPF) |
Autodiscover lets Outlook find server settings from just an address and password. Delete MX records pointing to the old mail server so messages are not split. Keep a single SPF record: if your website also sends mail from hosting, merge it, for example v=spf1 include:spf.protection.outlook.com a mx -all. Use ~all temporarily if you are not yet sure about every sender.
DKIM with two CNAME selectors
Microsoft 365 configures DKIM with two CNAME records, selector1._domainkey and selector2._domainkey, pointing to Microsoft hosts based on your tenant name. Find the exact values in the Microsoft Defender portal under email authentication settings, DKIM, and enable signing there once the records propagate. Two selectors allow safe key rotation.
selector1._domainkey CNAME selector1-example-uz._domainkey.tenant.onmicrosoft.com.
selector2._domainkey CNAME selector2-example-uz._domainkey.tenant.onmicrosoft.com.
_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.uz"These values are only samples. Start DMARC with p=none and tighten it after reviewing reports. The admin center may also list optional records, such as enterpriseregistration and enterpriseenrollment CNAMEs for Intune or Teams-related SRV records; add them only if you use those services.
Example: an accounting firm in Tashkent
A ten-person accounting firm in Mirabad swaps Excel files with clients and meets in Teams, so it chose Microsoft 365. The administrator verified the domain with the MS= record, then on a Friday evening added MX, autodiscover and SPF and removed the old hosting MX. Because the website's contact form sends mail from hosting, a mx was added to SPF. By Monday the DKIM selectors had propagated and signing was enabled. Staff connected Outlook with only their address and password.
Checking the result
dig +short TXT example.uz
dig +short MX example.uz
dig +short CNAME autodiscover.example.uz
dig +short CNAME selector1._domainkey.example.uzThe domain page in the admin center also reports missing records, and Microsoft Remote Connectivity Analyzer tests Autodiscover and mail flow from outside. Finally, send a test message to an external mailbox and confirm SPF, DKIM and DMARC show "pass".