check before: 2026-07-01
Product:
Exchange, Microsoft 365 admin center, Microsoft Graph
Platform:
Developer, Online, World tenant
Status:
Change type:
Admin impact, Updated message
Links:
Details:
Summary:
Starting July 1, 2026, A records for new Accepted Domains will use subdomains under mx.microsoft to support DNSSEC. Automation relying on mail.protection.outlook.com must update to use the List serviceConfigurationRecords Graph API for MX records. DNSSEC benefits apply automatically if enabled.
Details:
Updated February 2, 2026: We have updated the timeline. Thank you for your patience.
We're making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after July 1st, 2026 (previously February 1st). Between early and late July 2026 (previously February), we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft.
We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS.
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
Created:
2025-04-05
updated:
2026-02-03
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
summary for non-techies**
Starting July 1, 2026, your law firm's mail address format will change from "mail.protection.outlook.com" to "subdomain.mx.microsoft" to implement DNSSEC for enhanced security, requiring updates to automated systems using the List serviceConfigurationRecords Graph API to ensure continued mail delivery.
Direct effects for Operations**
DNS Resolution Issues
If the change is implemented without preparation, new Accepted Domains may experience DNS resolution failures, leading to email delivery issues.
- roles: IT Administrator, Email Administrator
- references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http
Automation Failures
Existing automation workflows that rely on mail.protection.outlook.com for MX record creation will fail, causing delays in domain setup and email flow.
- roles: DevOps Engineer, IT Administrator
- references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http
User Experience Degradation
Users may experience delays or failures in receiving emails if the MX records are not updated correctly, impacting communication.
- roles: End User, Email Administrator
- references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http
Increased Support Tickets
The change may lead to an increase in support tickets from users experiencing email issues, straining IT support resources.
- roles: Help Desk Technician, IT Support Manager
- references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http
Compliance Risks
Failure to implement DNSSEC correctly may expose the organization to security risks, including DNS spoofing, affecting compliance with security policies.
- roles: Compliance Officer, IT Security Manager
- references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http
Configutation Options**
XXXXXXX ... paid membership only
Opportunities**
XXXXXXX ... free basic plan only
Potentional Risks**
XXXXXXX ... paid membership only
IT Security**
XXXXXXX ... paid membership only
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
change history
| Date | Property | old | new |
| 2026-02-03 | MC prepare | If you have any automation in place, for example in workflows for Domain Setup, for MX record creation that expects A records for newly provisioned Accepted Domains to be provisioned in mail.protection.outlook.com, this automation needs to be updated by February 1st, 2025 (previously October 1st) to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After February 1st, 2025 (previously October 1st), List serviceConfigurationRecords Graph API will be the only source of truth for your Accepted Domains' MX record value. You will not be able to rely on the Accepted Domain's A record being provisioned in mail.protection.outlook.com after February 1st, 2025 (previously October 1st).
If you are using automation that expects the record to end with mail.protection.outlook.com, when you add a new Accepted Domain to the Exchange Admin Center after February 1st, 2025 (previously October 1st), mail flow may not work upon initial configuration and you will have to update your MX record to match what the Exchange Admin Center says for the domain or use the mailExchange value returned by List serviceConfigurationRecords Graph API. If you expect this change to cause any issues for your organization, please share that feedback. https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http | If you have any automation in place, for example in workflows for Domain Setup, for MX record creation that expects A records for newly provisioned Accepted Domains to be provisioned in mail.protection.outlook.com, this automation needs to be updated by July 1, 2026 (previously February 1) to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After July 1, 2026 (previously February 1), List serviceConfigurationRecords Graph API will be the only source of truth for your Accepted Domains' MX record value. You will not be able to rely on the Accepted Domain's A record being provisioned in mail.protection.outlook.com after July 1, 2026 (previously February 1).
If you are using automation that expects the record to end with mail.protection.outlook.com, when you add a new Accepted Domain to the Exchange Admin Center after July 1, 2026 (previously February 1), mail flow may not work upon initial configuration and you will have to update your MX record to match what the Exchange Admin Center says for the domain or use the mailExchange value returned by List serviceConfigurationRecords Graph API. If you expect this change to cause any issues for your organization, please share that feedback. https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http |
| 2026-02-03 | MC Summary | Starting February 1, 2025, A records for new Accepted Domains will be provisioned under mx.microsoft instead of mail.protection.outlook.com to support DNSSEC adoption. Update any automation to use the List serviceConfigurationRecords Graph API for MX records by this date to avoid mail flow issues. | Starting July 1, 2026, A records for new Accepted Domains will use subdomains under mx.microsoft to support DNSSEC. Automation relying on mail.protection.outlook.com must update to use the List serviceConfigurationRecords Graph API for MX records. DNSSEC benefits apply automatically if enabled. |
| 2026-02-03 | MC Last Updated | 10/02/2025 18:59:10 | 2026-02-02T22:52:05Z |
| 2026-02-03 | MC Messages | Updated October 2, 2025: We have updated the timeline. Thank you for your patience.
We're making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after February 1st, 2025 (previously October 1st). Between early and late February 2026 (previously early October and late October), we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft. We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS. | Updated February 2, 2026: We have updated the timeline. Thank you for your patience.
We're making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after July 1st, 2026 (previously February 1st). Between early and late July 2026 (previously February), we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft. We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS. |
| 2026-02-03 | MC Action Required By | 02/01/2026 08:00:00 | 2026-07-01T09:00:00Z |
| 2026-02-03 | MC How Affect | After February 1st, 2025 (previously October 1st), all A records for new Accepted Domains will be provisioned into the new subdomains under mx.microsoft.February 1st, 2025 (previously October 1st) is not secured with DNSSEC at the domain level (ex. contoso.com), then DNS resolution will work as usual. If an Accepted Domain you add to the EAC after February 1st, 2025 (previously October 1st) is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft DNS record automatically and you will get the benefits of DNSSEC without having to take any further action. Any issues with DNSSEC can be addressed by disabling DNSSEC for the Accepted Domain (ex. contoso.com) via your DNS provider. | After July 1, 2026 (previously February 1), all A records for new Accepted Domains will be provisioned into the new subdomains under mx.microsoft. July 1, 2026 (previously February 1) if not secured with DNSSEC at the domain level (ex. contoso.com), then DNS resolution will work as usual. If an Accepted Domain you add to the EAC after July 1, 2026 (previously February 1) is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft DNS record automatically and you will get the benefits of DNSSEC without having to take any further action. Any issues with DNSSEC can be addressed by disabling DNSSEC for the Accepted Domain (ex. contoso.com) via your DNS provider. |
| 2026-02-03 | MC End Time | 12/31/2025 09:00:00 | 2026-08-31T10:00:00Z |
| 2025-10-02 | MC prepare | If you have any automation in place, for example in workflows for Domain Setup, for MX record creation that expects A records for newly provisioned Accepted Domains to be provisioned in mail.protection.outlook.com, this automation needs to be updated by October 1st (previously August 1st) to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After October 1st (previously August 1st), List serviceConfigurationRecords Graph API will be the only source of truth for your Accepted Domains' MX record value. You will not be able to rely on the Accepted Domain's A record being provisioned in mail.protection.outlook.com after October 1st (previously August 1st.
If you are using automation that expects the record to end with mail.protection.outlook.com, when you add a new Accepted Domain to the Exchange Admin Center after October 1st (previously August 1st), mail flow may not work upon initial configuration and you will have to update your MX record to match what the Exchange Admin Center says for the domain or use the mailExchange value returned by List serviceConfigurationRecords Graph API. If you expect this change to cause any issues for your organization, please share that feedback. https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http | If you have any automation in place, for example in workflows for Domain Setup, for MX record creation that expects A records for newly provisioned Accepted Domains to be provisioned in mail.protection.outlook.com, this automation needs to be updated by February 1st, 2025 (previously October 1st) to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After February 1st, 2025 (previously October 1st), List serviceConfigurationRecords Graph API will be the only source of truth for your Accepted Domains' MX record value. You will not be able to rely on the Accepted Domain's A record being provisioned in mail.protection.outlook.com after February 1st, 2025 (previously October 1st).
If you are using automation that expects the record to end with mail.protection.outlook.com, when you add a new Accepted Domain to the Exchange Admin Center after February 1st, 2025 (previously October 1st), mail flow may not work upon initial configuration and you will have to update your MX record to match what the Exchange Admin Center says for the domain or use the mailExchange value returned by List serviceConfigurationRecords Graph API. If you expect this change to cause any issues for your organization, please share that feedback. https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http |
| 2025-10-02 | MC Summary | Starting October 1, 2025, A records for new Accepted Domains will be provisioned under mx.microsoft to support DNSSEC adoption. Automation relying on mail.protection.outlook.com must update to use the List serviceConfigurationRecords Graph API for MX records. DNS resolution will fallback if DNSSEC is not enabled. | Starting February 1, 2025, A records for new Accepted Domains will be provisioned under mx.microsoft instead of mail.protection.outlook.com to support DNSSEC adoption. Update any automation to use the List serviceConfigurationRecords Graph API for MX records by this date to avoid mail flow issues. |
| 2025-10-02 | MC Last Updated | 08/22/2025 19:29:54 | 2025-10-02T18:59:10Z |
| 2025-10-02 | MC Messages | Updated August 22, 2025: We have updated the content. Thank you for your patience.
We're making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after October 1st, 2025 (previously August 1st). Between early and late October 2025 (previously early August and late August), we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft. We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS. | Updated October 2, 2025: We have updated the timeline. Thank you for your patience.
We're making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after February 1st, 2025 (previously October 1st). Between early and late February 2026 (previously early October and late October), we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft. We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS. |
| 2025-10-02 | MC Action Required By | 07/01/2025 09:00:00 | 2026-02-01T08:00:00Z |
| 2025-10-02 | MC How Affect | After October 1st, 2025 (previously August 1st), all A records for new Accepted Domains will be provisioned into the new subdomains under mx.microsoft.
DNS resolution will safely fallback to "plain" DNS if a domain is not DNSSEC enabled. If an Accepted Domain you add to the Exchange Admin Center after October 1st (previously August 1st) is not secured with DNSSEC at the domain level (ex. contoso.com), then DNS resolution will work as usual. If an Accepted Domain you add to the EAC after October 1st (previously August 1st) is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft DNS record automatically and you will get the benefits of DNSSEC without having to take any further action. Any issues with DNSSEC can be addressed by disabling DNSSEC for the Accepted Domain (ex. contoso.com) via your DNS provider. | After February 1st, 2025 (previously October 1st), all A records for new Accepted Domains will be provisioned into the new subdomains under mx.microsoft.February 1st, 2025 (previously October 1st) is not secured with DNSSEC at the domain level (ex. contoso.com), then DNS resolution will work as usual. If an Accepted Domain you add to the EAC after February 1st, 2025 (previously October 1st) is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft DNS record automatically and you will get the benefits of DNSSEC without having to take any further action. Any issues with DNSSEC can be addressed by disabling DNSSEC for the Accepted Domain (ex. contoso.com) via your DNS provider. |
| 2025-08-23 | MC Messages | Updated August 6, 2025: We have updated the timeline. Thank you for your patience.
We're making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after August 1st, 2025. Between early August and late August, 2025 (previously July 1st and August 1st, we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft. We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS. | Updated August 22, 2025: We have updated the content. Thank you for your patience.
We're making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after October 1st, 2025 (previously August 1st). Between early and late October 2025 (previously early August and late August), we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft. We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS. |
| 2025-08-23 | MC How Affect | After August 1st, 2025, all A records for new Accepted Domains will be provisioned into the new subdomains under mx.microsoft.
DNS resolution will safely fallback to "plain" DNS if a domain is not DNSSEC enabled. If an Accepted Domain you add to the Exchange Admin Center after August 1st is not secured with DNSSEC at the domain level (ex. contoso.com), then DNS resolution will work as usual. If an Accepted Domain you add to the EAC after August 1st is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft DNS record automatically and you will get the benefits of DNSSEC without having to take any further action. Any issues with DNSSEC can be addressed by disabling DNSSEC for the Accepted Domain (ex. contoso.com) via your DNS provider. | After October 1st, 2025 (previously August 1st), all A records for new Accepted Domains will be provisioned into the new subdomains under mx.microsoft.
DNS resolution will safely fallback to "plain" DNS if a domain is not DNSSEC enabled. If an Accepted Domain you add to the Exchange Admin Center after October 1st (previously August 1st) is not secured with DNSSEC at the domain level (ex. contoso.com), then DNS resolution will work as usual. If an Accepted Domain you add to the EAC after October 1st (previously August 1st) is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft DNS record automatically and you will get the benefits of DNSSEC without having to take any further action. Any issues with DNSSEC can be addressed by disabling DNSSEC for the Accepted Domain (ex. contoso.com) via your DNS provider. |
| 2025-08-23 | MC Last Updated | 08/06/2025 21:56:26 | 2025-08-22T19:29:54Z |
| 2025-08-23 | MC prepare | If you have any automation in place, for example in workflows for Domain Setup, for MX record creation that expects A records for newly provisioned Accepted Domains to be provisioned in mail.protection.outlook.com, this automation needs to be updated by August 1st to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After August 1st, List serviceConfigurationRecords Graph API will be the only source of truth for your Accepted Domains' MX record value. You will not be able to rely on the Accepted Domain's A record being provisioned in mail.protection.outlook.com after August 1st.
If you are using automation that expects the record to end with mail.protection.outlook.com, when you add a new Accepted Domain to the Exchange Admin Center after August 1st, mail flow may not work upon initial configuration and you will have to update your MX record to match what the Exchange Admin Center says for the domain or use the mailExchange value returned by List serviceConfigurationRecords Graph API. If you expect this change to cause any issues for your organization, please share that feedback. https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http | If you have any automation in place, for example in workflows for Domain Setup, for MX record creation that expects A records for newly provisioned Accepted Domains to be provisioned in mail.protection.outlook.com, this automation needs to be updated by October 1st (previously August 1st) to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After October 1st (previously August 1st), List serviceConfigurationRecords Graph API will be the only source of truth for your Accepted Domains' MX record value. You will not be able to rely on the Accepted Domain's A record being provisioned in mail.protection.outlook.com after October 1st (previously August 1st.
If you are using automation that expects the record to end with mail.protection.outlook.com, when you add a new Accepted Domain to the Exchange Admin Center after October 1st (previously August 1st), mail flow may not work upon initial configuration and you will have to update your MX record to match what the Exchange Admin Center says for the domain or use the mailExchange value returned by List serviceConfigurationRecords Graph API. If you expect this change to cause any issues for your organization, please share that feedback. https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http |
| 2025-08-23 | MC Summary | Starting August 1, 2025, new Accepted Domains' A records will be provisioned under mx.microsoft subdomains to support DNSSEC adoption. Automation relying on mail.protection.outlook.com must update by August 1 to use the List serviceConfigurationRecords Graph API for MX records. DNS resolution will fallback if DNSSEC is not enabled. | Starting October 1, 2025, A records for new Accepted Domains will be provisioned under mx.microsoft to support DNSSEC adoption. Automation relying on mail.protection.outlook.com must update to use the List serviceConfigurationRecords Graph API for MX records. DNS resolution will fallback if DNSSEC is not enabled. |
| 2025-08-07 | MC prepare | If you have any automation in place, for example in workflows for Domain Setup, for MX record creation that expects A records for newly provisioned Accepted Domains to be provisioned in mail.protection.outlook.com, this automation needs to be updated by July 1st to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After July 1st, List serviceConfigurationRecords Graph API will be the only source of truth for your Accepted Domains' MX record value. You will not be able to rely on the Accepted Domain's A record being provisioned in mail.protection.outlook.com after July 1st.
If you are using automation that expects the record to end with mail.protection.outlook.com, when you add a new Accepted Domain to the Exchange Admin Center after July 1st, mail flow may not work upon initial configuration and you will have to update your MX record to match what the Exchange Admin Center says for the domain or use the mailExchange value returned by List serviceConfigurationRecords Graph API. If you expect this change to cause any issues for your organization, please share that feedback. https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http | If you have any automation in place, for example in workflows for Domain Setup, for MX record creation that expects A records for newly provisioned Accepted Domains to be provisioned in mail.protection.outlook.com, this automation needs to be updated by August 1st to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After August 1st, List serviceConfigurationRecords Graph API will be the only source of truth for your Accepted Domains' MX record value. You will not be able to rely on the Accepted Domain's A record being provisioned in mail.protection.outlook.com after August 1st.
If you are using automation that expects the record to end with mail.protection.outlook.com, when you add a new Accepted Domain to the Exchange Admin Center after August 1st, mail flow may not work upon initial configuration and you will have to update your MX record to match what the Exchange Admin Center says for the domain or use the mailExchange value returned by List serviceConfigurationRecords Graph API. If you expect this change to cause any issues for your organization, please share that feedback. https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http |
| 2025-08-07 | MC MessageTagNames | Admin impact | Updated message, Admin impact |
| 2025-08-07 | MC Summary | Starting August 1, 2025, new Accepted Domains' A records will be provisioned under mx.microsoft subdomains to support DNSSEC adoption. Automation relying on mail.protection.outlook.com must update by August 1 to use the List serviceConfigurationRecords Graph API for MX records. DNS resolution will fallback if DNSSEC is not enabled. | |
| 2025-08-07 | MC Last Updated | 04/05/2025 01:12:45 | 2025-08-06T21:56:26Z |
| 2025-08-07 | MC Messages | We're making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after July 1st, 2025. Between July 1st and August 1st, 2025, we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft.
We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS. | Updated August 6, 2025: We have updated the timeline. Thank you for your patience.
We're making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after August 1st, 2025. Between early August and late August, 2025 (previously July 1st and August 1st, we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft. We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS. |
| 2025-08-07 | MC Title | DNS Provisioning Change | (Updated) DNS Provisioning Change |
| 2025-08-07 | MC How Affect | After August 1st 2025, all A records for new Accepted Domains will be provisioned into the new subdomains under mx.microsoft.
DNS resolution will safely fallback to "plain" DNS if a domain is not DNSSEC enabled. If an Accepted Domain you add to the Exchange Admin Center after July 1st is not secured with DNSSEC at the domain level (ex. contoso.com), then DNS resolution will work as usual. If an Accepted Domain you add to the EAC after July 1st is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft DNS record automatically and you will get the benefits of DNSSEC without having to take any further action. Any issues with DNSSEC can be addressed by disabling DNSSEC for the Accepted Domain (ex. contoso.com) via your DNS provider. | After August 1st, 2025, all A records for new Accepted Domains will be provisioned into the new subdomains under mx.microsoft.
DNS resolution will safely fallback to "plain" DNS if a domain is not DNSSEC enabled. If an Accepted Domain you add to the Exchange Admin Center after August 1st is not secured with DNSSEC at the domain level (ex. contoso.com), then DNS resolution will work as usual. If an Accepted Domain you add to the EAC after August 1st is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft DNS record automatically and you will get the benefits of DNSSEC without having to take any further action. Any issues with DNSSEC can be addressed by disabling DNSSEC for the Accepted Domain (ex. contoso.com) via your DNS provider. |
Last updated 3 weeks ago ago
