On this page

Fixing DANE in AWS Route 53 for Microsoft 365

What this fixes

DANE lets receiving mail servers verify your mail server's certificate through DNS instead of a public CA. See Setting Up DANE for Email for the general mechanism — this guide covers the Microsoft 365 + Route 53 specific path.

This isn't a record you hand-author. Microsoft 365 supports "Inbound SMTP DANE with DNSSEC" as a managed feature: you enable DNSSEC on your zone and point MX at a Microsoft-supplied hostname, then Microsoft automatically provisions and publishes the TLSA record on its own infrastructure.

Step 1: Enable DNSSEC in Route 53

Follow Fixing DNSSEC in AWS Route 53 first — DANE can't be enabled until DNSSEC signing is active and validating on your hosted zone.

Step 2: Enable DNSSEC in Microsoft 365

  1. In Exchange Online PowerShell, run Enable-DnssecForVerifiedDomain for your domain.

Step 3: Swap in Microsoft's DANE-specific MX record

  1. Microsoft will provide a new MX target ending in .mx.microsoft (distinct from the standard mail.protection.outlook.com MX record).
  2. In your Route 53 hosted zone, edit your existing MX record (or create the new one) to point to the .mx.microsoft hostname Microsoft gave you.
  3. Once mail flow is confirmed working on the new MX record, remove the old mail.protection.outlook.com MX entry.

Step 4: Turn on inbound SMTP DANE

  1. In Exchange Online PowerShell, run Enable-SmtpDaneInbound for your domain.
  2. Microsoft automatically provisions the TLSA record on its .mx.microsoft hostname — you don't create one yourself in Route 53.
  3. Re-run your scan to confirm.

Limitations

  • Not supported for self-service/"viral" sign-up domains, or your tenant's own *.onmicrosoft.com domain.
  • Microsoft recommends keeping an MTA-STS policy active alongside DANE.

Common pitfalls

  • Looking for a way to manually create a TLSA record in Route 53 for this — Route 53 supports TLSA generally, but for M365's managed DANE flow, Microsoft publishes it on its own hostname instead.
  • Getting the KMS/DNSSEC signing step wrong before attempting this — confirm DNSSEC status is fully Active in Route 53 before enabling DANE in Microsoft 365.