MC1048624 – (Updated) DNS Provisioning Change

Product:

Exchange, Microsoft 365 admin center, Microsoft Graph

Platform:

Developer, Online, World tenant

Status:

Change type:

Admin impact, Updated message

Links:

Details:

Summary:
Starting February 1, 2025, A records for new Accepted Domains will be provisioned under mx.microsoft instead of mail.protection.outlook.com to support DNSSEC adoption. Update any automation to use the List serviceConfigurationRecords Graph API for MX records by this date to avoid mail flow issues.

Details:
Updated October 2, 2025: We have updated the timeline. Thank you for your patience.
We're making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after February 1st, 2025 (previously October 1st). Between early and late February 2026 (previously early October and late October), we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft.
We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2025-04-05

updated:
2025-10-02

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Mail Flow Disruption
If automation expecting A records to be provisioned under mail.protection.outlook.com is not updated, mail flow may fail for new Accepted Domains.
   - roles: Exchange Administrator, IT Support
   - references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http

Increased Support Tickets
Users may experience issues with email delivery, leading to an increase in support tickets and user frustration.
   - roles: Help Desk Staff, IT Support
   - references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http

Automation Failures
Existing automation workflows that rely on the old A record provisioning will fail, requiring immediate updates to avoid disruptions.
   - roles: DevOps Engineer, System Administrator
   - references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http

User Experience Degradation
Users may face delays in email communication due to misconfigured MX records, impacting productivity.
   - roles: End Users, Project Managers
   - references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http

DNSSEC Adoption Issues
Organizations not prepared for DNSSEC may face challenges in securing their domains, leading to potential security vulnerabilities.
   - roles: Network Administrator, Security Officer
   - references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http

Configutation Options**

XXXXXXX ... paid membership only

Opportunities**

XXXXXXX ... free basic plan only

Potentional Risks**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Imagine you're managing a large office building. Traditionally, when someone wanted to send a letter to a specific department, they would use a well-known address format. Let's say the address was "mail.protection.outlook.com." This address worked well for a long time, but now there's a new system in place that offers better security features, much like upgrading the building's security system to prevent unauthorized access.

Starting February 1, 2025, the address format for new departments (or "Accepted Domains" in tech terms) will change to "mx.microsoft." This change is like updating the building's directory to use a new, more secure address format. The reason for this change is to adopt a security protocol called DNSSEC, which acts like a digital lock and key system, ensuring that the mail reaches the right department without being intercepted or tampered with.

If your office has an automated system that directs mail based on the old address format, you'll need to update it to recognize the new format by February 1, 2025. Think of it as reprogramming your office's mail sorting machine to understand the new directory. This update is crucial because after this date, the old address format won't work for new departments, and mail might not be delivered correctly.

To help with this transition, there's a new tool available called the List serviceConfigurationRecords Graph API. It's like a digital assistant that provides the correct address for each department. By using this tool, you can ensure that your mail sorting system always has the latest and most accurate address information.

If you don't update your system, it's like continuing to send mail to an old address that no longer exists. The mail won't reach its destination, and you'll need to manually check the new directory to find the correct address. To avoid disruptions, it's important to make these updates before the deadline.

If you foresee any challenges with this change, it's important to communicate them so that solutions can be found. This way, the transition to the new, more secure system can be as smooth as possible for everyone involved.