On this page

Fixing DANE in SiteGround for Microsoft 365

Why you can't fix this

Microsoft 365 supports "Inbound SMTP DANE with DNSSEC" as a managed feature — but DNSSEC on your own domain zone is a hard prerequisite, and SiteGround does not support DNSSEC. Per SiteGround's own knowledge base, DNSSEC records cannot be added or edited for domains registered with SiteGround, unconditionally. See Fixing DNSSEC in SiteGround for that finding, and Setting Up DANE for Email for how DANE works in general.

Without DNSSEC, Microsoft won't let you enable the DANE flow at all — this isn't a matter of finding the right TLSA record field in SiteGround's DNS Zone Editor; the process never gets that far.

What to do instead

Move DNS management to a provider that supports DNSSEC (e.g. Cloudflare, set up as a free DNS-only zone) while keeping hosting on SiteGround. Then follow Fixing DANE in Cloudflare for Microsoft 365 for the actual setup steps. In the meantime, Microsoft recommends an MTA-STS policy as a complementary (and independently achievable) protection — that only needs a TXT record and an HTTPS-hosted policy file, both of which SiteGround can host as-is.

Common pitfalls

  • Assuming this is a Microsoft 365 configuration issue — the actual blocker is entirely on the DNS side (SiteGround's lack of DNSSEC).