check before: 2025-07-01
Product:
Exchange, Microsoft 365 admin center, Microsoft Graph
Platform:
Developer, Online, World tenant
Status:
Change type:
Admin impact
Links:
Details:
We're making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after July 1st, 2025. Between July 1st and August 1st, 2025, we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft.
We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS.
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
Created:
2025-04-05
updated:
2025-04-05
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
summary for non-techies**
Starting in July 2025, Microsoft will change the storage location of A records for new domains to support DNSSEC, requiring updates to automated systems that manage email settings to ensure proper email delivery.
Direct effects for Operations**
DNS Resolution Issues
If automation relies on the old A record provisioning method, mail flow may not work initially for new Accepted Domains, leading to potential email delivery failures.
- roles: Exchange Administrator, IT Support Specialist
- references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http
Automation Breakage
Existing workflows for Domain Setup that expect A records in mail.protection.outlook.com will break, requiring updates to use the new Graph API for MX records.
- roles: DevOps Engineer, Exchange Administrator
- references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http
User Experience Degradation
Users may experience delays or failures in email delivery if the DNS changes are not properly managed, impacting communication.
- roles: End User, IT Support Specialist
- references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http
Increased Support Tickets
The change may lead to an increase in support requests from users experiencing issues with email flow, straining IT resources.
- roles: IT Support Specialist, Help Desk Technician
- references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http
Potential Security Risks
If DNSSEC is not properly implemented, there may be vulnerabilities to DNS spoofing or man-in-the-middle attacks, affecting data integrity.
- roles: Network Administrator, Security Analyst
- references: https://learn.microsoft.com/graph/api/domain-list-serviceconfigurationrecords?view=graph-rest-1.0&tabs=http
Configutation Options**
XXXXXXX ... paid membership only
Opportunities**
XXXXXXX ... free basic plan only
Potentional Risks**
XXXXXXX ... paid membership only
IT Security**
XXXXXXX ... paid membership only
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
Last updated 2 weeks ago
