MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
An administrator has added the custom domain 'contoso.co.uk' to their Microsoft 365 tenant and verified ownership. Users now need to receive email at @contoso.co.uk. Which DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?
⚠ Common exam trap
Candidates often confuse DNS records required for email routing (MX) with records required for email security or client discovery (SPF, DKIM, Autodiscover), leading them to select a record that does not actually deliver inbound messages.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an MX record pointing to <tenant>.mail.protection.outlook.com
To route email for a custom domain to Exchange Online, you must add an MX record in the public DNS zone that points to the Exchange Online mail exchanger. The correct target is <tenant>.mail.protection.outlook.com, where <tenant> is your initial tenant name (e.g., contoso-com). This MX record tells sending mail servers to deliver messages for @contoso.co.uk to Microsoft's email infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add an MX record pointing to <tenant>.mail.protection.outlook.com
Why this is correct
The MX record is the authoritative DNS mechanism that routes incoming SMTP mail for a domain. For Microsoft 365, it must be configured to point to <tenant>.mail.protection.outlook.com, the Exchange Online boundary, to ensure external senders deliver messages to your mailboxes. Without this record, email addressed to your domain will not reach Exchange Online, even if all other DNS records are present.
- ✗
Add a CNAME record for autodiscover
Why it's wrong here
The autodiscover CNAME, such as autodiscover.contoso.co.uk pointing to autodiscover.outlook.com, only enables email clients to automatically configure server settings like the mailbox server and protocol URLs. It simplifies client setup and does not affect the SMTP delivery path; incoming messages still route based solely on the MX record. Even if this CNAME is absent, mail delivery succeeds because DNS resolution for message transfer uses MX records exclusively, and clients can be configured manually.
- ✗
Add an SPF record
Why it's wrong here
SPF (Sender Policy Framework) is a TXT record that declares which servers are authorized to send email from your domain, and for Exchange Online it typically includes include:spf.protection.outlook.com. Its purpose is to authenticate outbound mail and reduce spoofing by allowing receiving servers to validate the envelope sender, but it has no influence on where inbound mail is delivered. Unless an MX record directs to Exchange Online, SPF alone will not cause incoming messages to reach your mailboxes.
- ✗
Add a DKIM record
Why it's wrong here
DKIM (DomainKeys Identified Mail) requires a CNAME record published in DNS that provides a public key, which receiving mail systems use to verify that messages originated from your domain and were not tampered with during transit. While this strengthens outbound email authentication and helps prevent phishing and spoofing, it is fundamentally unrelated to inbound message routing. The MX record is solely responsible for telling other mail servers where to deliver email destined for your domain, so adding DKIM cannot replace or compensate for a missing or incorrect MX record.
Visual reference
Go deeper
Related to this question
Learn chapter
Threat Protection in M365
Key term
Microsoft 365 tenant
A Microsoft 365 tenant is a dedicated, isolated instance of Microsoft 365 services created for an organization when they sign up for a subscription.
Key term
Custom domain
A custom domain is a personalized internet address (like contoso.com) that you can use with cloud services instead of the default domain provided by the service provider.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.