Add a Domain to Microsoft 365 Without Breaking Your Website

Before you start: what can break and how to avoid it

Your domain's DNS holds separate records for separate jobs. The A or CNAME records for yourdomain.sg and www point to your website host. The MX records decide where email is delivered. Microsoft 365 only needs to change email-related records. Your website records should not be touched at all.

Problems usually come from three places: moving the domain's nameservers to a new provider without copying every existing record, deleting 'old' records the wizard did not mention, or switching MX before mailboxes exist. Our guide to connecting a domain to a website without breaking email covers the same risk from the other direction.

Step 1: Add and verify the domain in Microsoft 365

Microsoft's add a domain guide offers two routes: Domain Connect, where Microsoft adds records at a supported registrar for you, and Manual. Choose Manual unless you are certain the automated changes will not overwrite anything. Microsoft itself warns that incorrect DNS records can cause email and service outages.

1. 1

   Open Settings, Domains, Add domain

   In the Microsoft 365 admin centre, go to Settings, then Domains, then + Add domain, and enter yourdomain.sg.

2. 2

   Choose to verify with a TXT record

   Microsoft shows a TXT value that starts with MS=. Avoid the MX verification option unless TXT is impossible.

3. 3

   Add the TXT record at your DNS host

   Create a TXT record on the root of the domain (@) with Microsoft's value. It does not affect your website or email.

4. 4

   Select Verify

   Microsoft says verification usually takes up to 10 minutes, and up to 48 hours with some registrars.

5. 5

   Choose to add your own DNS records

   When asked how to connect the domain, pick the option to add DNS records yourself rather than letting Microsoft manage DNS.

Step 2: Create users and mailboxes before switching email

This is the step that prevents lost email. Microsoft's guidance is to add users and set up mailboxes for everyone who receives email on the domain after adding the domain but before changing the MX record.

Change each user's primary address to the new domain, add aliases such as info@ and accounts@, and set up shared mailboxes for team addresses. If you are moving from another provider, start copying old email now; our guide to migrating between Google Workspace and Microsoft 365 covers the migration itself.

Step 3: Add the Microsoft 365 DNS records manually

The admin centre's Add DNS records page shows the exact values for your tenant. Copy them from there rather than from any guide, because the MX value is specific to your domain.

Microsoft's record guide for any DNS host notes that Exchange Online supports TTL values under 6 hours. A short TTL such as 3600 seconds lets you roll back quickly. For background on each record type, see our DNS records explainer.

Step 4: Get SPF right if other services send email

Your website's contact form, your invoicing software or a newsletter tool may already send email as your domain. They usually have their own include in an existing SPF record. Microsoft's SPF set-up guide is clear that only one SPF record is allowed per domain, so you must merge rather than add a second one.

• Only Microsoft 365 sends: v=spf1 include:spf.protection.outlook.com -all
• Microsoft 365 plus another service: v=spf1 include:spf.protection.outlook.com include:otherservice.example -all (use the include the other service documents).
• Keep under 10 DNS lookups: each include counts, and SPF fails if the total is too high.

Use -all (fail) or ~all (soft fail) as you prefer, but start with ~all if you are unsure every sender is listed, then tighten it once DMARC reports show nothing legitimate failing.

Step 5: Turn on DKIM for your domain

DKIM signs outgoing email so receivers can confirm it really came from your tenant. Microsoft 365 does not sign with your custom domain until you set it up. Microsoft's DKIM configuration guide explains the two CNAME records.

1. 1

   Open the DKIM page in the Defender portal

   Go to Email & collaboration, Policies & rules, Threat policies, Email authentication settings, DKIM, and select your domain.

2. 2

   Copy the two CNAME values Microsoft shows

   The host names are always selector1._domainkey and selector2._domainkey. The targets are specific to your tenant.

3. 3

   Create both CNAMEs at your DNS host

   Copy the targets exactly. Some DNS hosts add your domain to the end of the host name automatically, so enter only selector1._domainkey if so.

4. 4

   Enable signing

   Back in the Defender portal, switch on 'Sign messages for this domain with DKIM signatures'. If it reports the records are missing, wait for DNS to update and try again.

Finish with a DMARC record, starting at p=none to collect reports. Our guide to SPF, DKIM and DMARC explains how to move to quarantine and reject safely.

Do it yourself or get help?

If you are comfortable in your DNS host's control panel and have a list of every address, a small team can do this in an afternoon. After switching MX, send test emails to and from Gmail and Outlook.com, check the website still loads, and confirm DKIM shows as signing.

Our Business Email Setup (S$249) adds your domain to Microsoft 365, creates mailboxes and sets SPF, DKIM and DMARC without touching your website records. If your DNS is messy or spread across providers, Domain & DNS Setup (S$99) tidies it first. Setting up Google Workspace instead? See our guide to adding a domain to Google Workspace.