Microsoft 365 DNS Propagation CheckerConfirm MX, SPF, DKIM, and CNAME records for Microsoft 365 are live globally
- 7 independent networks
- Records + DNS flags
- No ads, no sign-up
Independent networks
7 public DNS networks, queried in parallel
Every test query is answered by these unaffiliated resolvers on separate networks and infrastructure. When they agree, you can trust the result.
- 8.8.8.8
Google Public DNS
Google LLC · North America
- 1.1.1.1
Cloudflare
Cloudflare, Inc. · Global Anycast
- 94.140.14.14
AdGuard DNS
AdGuard Software Ltd. · Europe
- 45.90.28.0
NextDNS
NextDNS, Inc. · Global Anycast
- 185.222.222.222
DNS.SB
xTom / Layer0 · Europe
- 223.5.5.5
Alibaba DNS
Alibaba Cloud · Asia
- 119.29.29.29
DNSPod
Tencent Cloud · Asia
How it works
A test query for flag propagation check, done right
Most checkers query a single resolver or a set of geographically labelled servers behind the same anycast network. isPropagated queries genuinely independent DNS operators and compares both their records and their response flags.
Enter a domain and run the test query
Type any domain, pick a record type (A, AAAA, CNAME, MX, TXT, NS and more), then run a single test query that fans out to every network at once.
We query independent global networks
Instead of asking one resolver, we ask several unaffiliated public DNS networks in parallel — across North America, Europe and Asia — so no single cache can mislead you.
Compare records and DNS flags
Each network returns its answer plus the DNS response flags (AD, CD, RA, RD, TC). We check that both the records and the flags agree before calling a domain propagated.
Read the propagation verdict
A clear consensus score shows how many networks resolved the record and whether their answers match — so you know the moment a change is live everywhere.
What DNS records does Microsoft 365 require?
Microsoft 365 (Exchange Online) requires a specific set of DNS records: an MX record pointing to your tenant's mail endpoint (yourtenant.mail.protection.outlook.com), an SPF TXT record (v=spf1 include:spf.protection.outlook.com -all), CNAME records for Autodiscover and mobile device management, SRV records for Teams/Skype federation, and DKIM TXT records under the selector1 and selector2 subdomains.
The critical path for email is: MX propagation → SPF propagation → DKIM propagation. Microsoft 365's domain verification also requires a specific TXT record (or CNAME) to confirm domain ownership before email can be received. Until the MX record propagates, inbound email will continue to reach your previous mail server.
Microsoft 365's own DNS diagnostic tool in the Admin Center checks records from Microsoft's perspective. For an independent, multi-resolver view, use this checker to confirm each record type from 7 different public DNS networks simultaneously.
Microsoft 365 DNS record propagation order
Add all required DNS records before switching the MX record. This ensures Autodiscover, DKIM, and SPF are already in place when you cut over email routing. Check each record type independently: select MX, then TXT for SPF, then TXT for each DKIM selector, then CNAME for Autodiscover.
Microsoft 365 DKIM uses two selectors that rotate automatically: selector1._domainkey and selector2._domainkey. Both are CNAME records pointing to Microsoft's key infrastructure. Check both CNAMEs are live before enabling DKIM signing in the Microsoft 365 Defender portal.
FAQ
Common questions about microsoft 365 dns propagation checker
How long does Microsoft 365 DNS propagation take?
Most Microsoft 365 DNS records propagate within 1–4 hours with typical TTL settings. The domain verification check in the Microsoft 365 Admin Center may succeed before all global resolvers are updated, but full propagation — where every user worldwide reaches the correct endpoint — takes one full TTL cycle per record.
Microsoft 365 domain setup is stuck on "Checking DNS". What do I do?
Use this checker to verify each record is live on independent resolvers. If records look correct here but Microsoft's wizard still shows errors, wait 15–30 minutes and retry. Microsoft's own DNS checks may have cached a previous state. If records are genuinely not propagating, check for typos in the record values in your DNS provider dashboard.
What is the Microsoft 365 Autodiscover CNAME for?
Autodiscover.yourdomain.com is a CNAME pointing to autodiscover.outlook.com. Outlook and mobile clients use it to automatically discover your Exchange Online server settings. Without this CNAME, users must manually configure their email client with the Exchange Online server details.
Why does Microsoft 365 require two DKIM selectors (selector1 and selector2)?
Microsoft 365 uses DKIM key rotation for security. The two selectors allow Microsoft to rotate signing keys without any downtime or manual DNS changes from you — while one selector is active for signing, the other is being prepared. Both CNAME records must be present and propagated for key rotation to work automatically.