DNS cutover guide

At least 48 hours before your cutover window, lower the TTL on your MX, Autodiscover CNAME, and SPF TXT records to 300 seconds (5 minutes). This ensures DNS changes propagate quickly during the actual cutover.

In the cutover window, run a final delta sync to capture any emails received or sent since the last sync pass. This should complete in 15–60 minutes for most tenants.

Change your MX record to point to the destination tenant's Exchange Online mail server. The format is: [yourdomain]-com.mail.protection.outlook.com (with hyphens replacing dots in your domain).

• Remove the old source tenant MX record.
• Add the destination tenant MX record with priority 0.
• Set TTL to 300 seconds.
• Note the time — new mail will start arriving in the destination as soon as this propagates.

Update the Autodiscover CNAME to point to autodiscover.outlook.com. This is the same value for all M365 tenants — the record already exists if you were on M365 in the source, so this change is usually minimal.

Update your SPF TXT record to include the destination tenant's sending IP ranges. The standard M365 SPF include is: include:spf.protection.outlook.com. Remove the source tenant's include if it was different.

Send a test email to an address on your migrated domain from an external mailbox (Gmail, etc.). Confirm it arrives in the destination Exchange Online mailbox within 5 minutes of DNS propagation.

• Use MXToolbox to confirm the new MX record is resolving correctly.
• Check mail flow from internal users — send between two migrated mailboxes.
• If mail is not arriving, check the destination tenant's accepted domains — your domain must be listed there.

Autodiscover should reconfigure Outlook clients automatically within 1–2 hours of DNS propagation. Users will see a prompt to restart Outlook or enter their password. If Outlook does not reconfigure, remove and re-add the account manually.

Enable DKIM signing in the destination Exchange Admin Center (Protection → DKIM) and update your DMARC policy to reference the new DKIM selectors. Failure to do this will cause SPF/DMARC failures on outbound mail.