MX Record for Email Routing to Exchange Online
An administrator has added a custom domain 'contoso.com' to their Microsoft 365 tenant and verified ownership. However, users are unable to receive emails sent to their custom domain. Which type of DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?
Quick Answer
The answer is the MX record, which must be added to the public DNS zone to route email to Exchange Online. This record type, short for Mail Exchange, tells sending mail servers where to deliver messages for your custom domain, such as contoso.com. Without it, inbound emails cannot reach the Exchange Online mail exchanger, typically formatted as contoso-com.mail.protection.outlook.com with a priority of 0. On the MS-102 exam, this question tests your understanding of DNS configuration for hybrid or cloud-only mail flow, often appearing as a scenario where users cannot receive email after domain verification. A common trap is confusing the MX record with CNAME or TXT records; remember that only the MX record controls mail routing, not domain ownership verification. For a memory tip, think “MX = Mail eXchange” and that it must point to the .mail.protection.outlook.com endpoint—if emails aren’t arriving, check that the MX record is present and correctly prioritized.
⚠ Common exam trap
Many exam-takers confuse the purpose of MX records with SPF or TXT records, thinking that SPF alone enables email delivery, when in fact MX records are the fundamental requirement for inbound mail routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MX record
The MX (Mail Exchange) record is the DNS record type that directs email messages to a specific mail server. For Exchange Online, the MX record must point to the tenant's mail exchanger (e.g., contoso-com.mail.protection.outlook.com) with a priority value (typically 0). Without this record, sending mail servers cannot route inbound emails to the custom domain's mailbox store in Exchange Online.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
TXT record
Why it's wrong here
A TXT record carries arbitrary verification or policy text such as domain ownership proof or SPF; it provides no mail exchanger, so senders cannot locate Exchange Online for contoso.com. It is tempting because TXT is genuinely the correct record type when proving domain ownership or publishing DKIM and SPF policy data.
- ✓
MX record
Why this is correct
An MX record specifies the mail exchanger accepting messages for contoso.com, directing inbound mail to Exchange Online's protection service. Without it, senders cannot locate a mail server, so users receive nothing despite verified domain ownership.
- ✗
CNAME record
Why it's wrong here
A CNAME aliases one hostname to another; mail routing requires an MX record pointing at Exchange Online's mail exchanger, so inbound mail to contoso.com is never delivered. It is tempting because CNAME is genuinely the correct record for autodiscover or other service hostnames that must resolve to a Microsoft endpoint.
- ✗
SPF record
Why it's wrong here
SPF is a TXT-based record authorising sending hosts for outbound mail; it does not direct inbound delivery, so mail to contoso.com still cannot reach Exchange Online. It is tempting because SPF is genuinely the correct record when recipients reject or spam-folder your outbound messages due to missing sender authorisation.
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Active Directory Domain Services (AADDS)
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
DNS record
A DNS record is a set of instructions stored on a DNS server that tells clients how to interact with a domain, most commonly by mapping a human-readable domain name to an IP address.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator has added the custom domain 'contoso.co.uk' to their Microsoft 365 tenant and verified ownership. Users now need to receive email at @contoso.co.uk. Which DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?
medium- ✓ A.Add an MX record pointing to <tenant>.mail.protection.outlook.com
- B.Add a CNAME record for autodiscover
- C.Add an SPF record
- D.Add a DKIM record
Why A: To route email for a custom domain to Exchange Online, you must add an MX record in the public DNS zone that points to the Exchange Online mail exchanger. The correct target is <tenant>.mail.protection.outlook.com, where <tenant> is your initial tenant name (e.g., contoso-com). This MX record tells sending mail servers to deliver messages for @contoso.co.uk to Microsoft's email infrastructure.
Variation 2. A company recently added the custom domain 'contoso.com' to their Microsoft 365 tenant. Users report that they cannot receive external email sent to their new domain addresses. The administrator confirmed that the domain status shows 'Active' in the Microsoft 365 admin center. What is the most likely cause of this issue?
easy- A.The domain was not verified with a TXT record.
- ✓ B.The MX record for the domain is missing or points to an incorrect mail server.
- C.The SPF record for the domain is missing or incorrectly configured.
- D.The custom domain was not added to the user's primary email address.
Why B: The domain status 'Active' in the Microsoft 365 admin center indicates that the domain has been successfully verified and added to the tenant. However, for external email to be delivered to users at that domain, the public MX record in DNS must point to Microsoft 365's mail servers (e.g., contoso-com.mail.protection.outlook.com). If the MX record is missing or points to an incorrect server, external senders cannot route email to the tenant, even though the domain is verified and active.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.