On this page

Fixing DANE in Cloudflare for Microsoft 365

What this fixes

DANE lets receiving mail servers verify your mail server's certificate through DNS instead of a public CA. See Setting Up DANE for Email for the general mechanism — this guide covers the Microsoft 365 + Cloudflare specific path.

This isn't a record you hand-author. Microsoft 365 supports "Inbound SMTP DANE with DNSSEC" as a managed feature: you enable DNSSEC on your zone and point MX at a Microsoft-supplied hostname, then Microsoft automatically provisions and publishes the TLSA record on its own infrastructure.

Step 1: Enable DNSSEC in Cloudflare

Follow Fixing DNSSEC in Cloudflare first — DANE can't be enabled until DNSSEC is active and validating on your domain.

Step 2: Enable DNSSEC in Microsoft 365

  1. In Exchange Online PowerShell, run Enable-DnssecForVerifiedDomain for your domain. This tells Microsoft your domain is DNSSEC-signed.

Step 3: Swap in Microsoft's DANE-specific MX record

  1. Microsoft will provide a new MX target ending in .mx.microsoft (distinct from the standard mail.protection.outlook.com MX record).
  2. In Cloudflare, go to DNS → Records, and either edit your existing MX record or add the new one, pointing to the .mx.microsoft hostname Microsoft gave you.
  3. Once mail flow is confirmed working on the new MX record, remove the old mail.protection.outlook.com MX entry.

Step 4: Turn on inbound SMTP DANE

  1. In Exchange Online PowerShell, run Enable-SmtpDaneInbound for your domain.
  2. Microsoft automatically provisions the TLSA record on its .mx.microsoft hostname — you don't create one yourself.
  3. Re-run your scan to confirm.

Limitations

  • Not supported for self-service/"viral" sign-up domains, or for your tenant's own *.onmicrosoft.com domain.
  • Microsoft recommends keeping an MTA-STS policy active alongside DANE, not as a replacement for it — the two are meant to work together.

Common pitfalls

  • Looking for a TLSA record to add yourself in Cloudflare — there isn't one; Microsoft publishes it on its own hostname once you complete the steps above.
  • Removing the old MX record before confirming the new .mx.microsoft one is delivering mail correctly.
  • Skipping DNSSEC on your own zone — this is a hard prerequisite before Microsoft will let you enable inbound DANE.