Setting up email on your own domain in Microsoft 365

Before you start: who controls your DNS

Every domain has DNS records, held by a DNS host. Often that is the registrar you bought the domain from, sometimes your web designer's hosting company, sometimes a service like Cloudflare. Before touching email, find out where your DNS is managed and make sure you, not just a former contractor, have the login. Many email projects stall for days because nobody in the business knows who registered the domain years ago or which email address the account recovery goes to.

Write down every existing DNS record before changing anything. Your website, booking system, online store and any third-party email senders such as your accounting software or newsletter tool may rely on specific records. A screenshot or export of the full zone takes two minutes and makes recovery simple if something breaks.

Adding and verifying the domain

In the Microsoft 365 admin centre, go to Settings, then Domains, and add your domain. Microsoft gives you a TXT record to add at your DNS host, which proves you own the domain. Verification usually completes within minutes, though some DNS hosts take longer to publish changes. If your DNS is with a provider Microsoft supports directly, the wizard can add records for you after you sign in, which reduces typing mistakes. Once verified, you can assign addresses on the new domain to users, even before mail is pointed to Microsoft. That lets you set everything up and test sending internally while the old system keeps receiving external email.

MX: where incoming mail goes

The MX record tells the rest of the internet where to deliver email for your domain. Changing it is the actual switch: once the new MX record takes effect, incoming mail flows into Microsoft 365 instead of your old provider. DNS changes take time to spread, so for a few hours some senders may still deliver to the old system.

Leave the old mailboxes running for at least a few days afterwards and check them for stragglers. Schedule the switch for a quiet time, such as a Friday afternoon or weekend, and move existing email from the old system into Microsoft 365 before or straight after the change. Staff should see their old mail in Outlook when they arrive on Monday, not an empty inbox.

SPF, DKIM and DMARC: proving mail is really yours

These three records stop other people sending email that pretends to be from your domain, and they help your genuine mail avoid spam folders. SPF lists which services may send on your behalf. DKIM adds a digital signature to each message, which Microsoft 365 can do once you publish two CNAME records and switch it on. DMARC tells receiving servers what to do with mail that fails those checks and where to send reports.

The common mistake is an SPF record that leaves out a legitimate sender. If your invoices come from Xero, your newsletters from a mailing service and your website form sends notifications, each needs to be covered, or those emails start landing in spam. Start DMARC in monitoring mode, read the reports for a few weeks to find every sender, then tighten it once you are confident nothing legitimate is failing.

Autodiscover and getting Outlook connected

An Autodiscover record helps Outlook find the right server when someone signs in. Without it, setting up Outlook on a new computer or phone can fail or loop asking for passwords. The admin centre lists the records it expects; once they are all showing as correct, Outlook connects using just the email address and password. Old profiles pointing at the previous mail system need removing and recreating.

Phones are easy to forget. Staff who set up their work email in the built-in mail app on an iPhone or Android using the old server settings will keep trying to reach the old system. Plan to move everyone onto the Outlook app, and check every device during the first week.

Domains, aliases and shared addresses

You can host several domains in one Microsoft 365 tenant, which helps when a business has a trading name and a legal name, or bought a second domain such as the .nz version of its .co.nz address. Each person can have extra addresses, called aliases, on any of those domains, all landing in the same mailbox. Decide which address each person sends from by default so replies are consistent.

Keep domain renewals on auto-renew with a current card and a monitored contact email. An expired domain stops email instantly, and an expired .nz domain can be picked up by someone else after the grace period. That is one of the most avoidable outages a small business can have, and it happens every year to businesses that assumed someone else was watching.