How to Set Up DNS for Microsoft 365 or Google Workspace

When your email moves to Microsoft 365 or Google Workspace, add DNS records that send mail to your new provider (MX) and prove your email is genuine (SPF, and DKIM, a hidden signature). Copy the exact values from your provider’s setup page; values here only help you check.

Where to add them

Add records wherever your domain’s DNS is managed. To find out, look up your domain at lookup.icann.org and check its nameservers. If they contain cloudflare.com, use Cloudflare and keep the records DNS only. If they contain your registrar’s name, use your registrar. If they’re Blue Arctic’s, use cPanel: open the Websites hub, click Manage next to your domain and open the DNS tab (or the Zone Editor icon, if you see that instead). If you can’t tell, open a support ticket.

Microsoft 365

1. In the Microsoft 365 admin center, select Show all, then Settings > Domains.
2. If your domain isn’t listed, select + Add domain, enter your domain and select Use this domain.
3. Choose Add a TXT record to the domain’s DNS records, select Continue, add the TXT record it shows, then select Verify.
4. Add your users and their mailboxes.
5. Back in Settings > Domains, select your domain, then DNS records, Manage DNS and Continue.
6. On the Add DNS records page, keep Exchange and Exchange Online Protection selected, then select Advanced options and DomainKeys Identified Mail (DKIM).
7. Expand MX Records, CNAME Records and TXT Records, and add each record exactly as shown, including both DKIM CNAME records. Give the MX record priority 0. Merge SPF as shown below. If your DNS editor says a record named autodiscover already exists, open a support ticket before you change it.
8. Delete any old MX records, then select Continue. When Microsoft finds the records, select Done.
9. To switch on DKIM, open security.microsoft.com/authentication, select the DKIM tab, then your domain, and turn on Sign messages for this domain with DKIM signatures. If Microsoft says the CNAME records are missing, check them against the values it shows and try again later.

Google Workspace

1. Create your users in Google Workspace.
2. Add the verification TXT record the Google Admin console shows during setup (it starts with google-site-verification=), and wait until Google confirms your domain.
3. Replace your MX records with one MX record: priority 1, value smtp.google.com. Delete the others.
4. In the Admin console, go to Menu > Apps > Google Workspace > Gmail > Authenticate email, choose your domain and click Generate New Record, then Generate.
5. Add the DKIM TXT record with the host name and value shown (the host usually starts with google._domainkey).
6. Return to Authenticate email and click Start authentication. DKIM can take up to 48 hours to start working.

Merge your SPF record

If your domain already has a TXT record starting with v=spf1, edit it instead of adding a second one. Keep everything already in it; those parts may cover your website’s own email. Add the new provider’s part just before the ending (~all or -all). Microsoft 365 uses include:spf.protection.outlook.com and Google Workspace uses include:_spf.google.com. For example, v=spf1 ip4:203.0.113.10 ~all becomes v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com ~all. Not sure? Ask in a support ticket.

Stop cPanel keeping the mail

If your website is on Blue Arctic Shared Web Hosting, cPanel reads only its own copy of your DNS. Unless its email routing changes, website emails to your own address (like contact-form messages) stay in the old mailbox. This applies wherever your DNS is managed.

About 3 days after you switch your MX records, once new email has stopped arriving in your Blue Arctic mailbox, open a support ticket and ask us to set your domain’s email routing to remote. Changing it earlier can bounce mail still on its way.

How to tell it worked

Your provider shows your domain as set up. A test email from an outside account (like a personal Gmail address) arrives in the new mailbox, your reply lands in that account’s inbox (not spam), and, once we’ve changed the email routing, a contact-form test arrives too.

Troubleshooting

• Some email still goes to the old mailbox: an old MX record remains, or the change is still spreading. Delete them and allow up to 72 hours (see How Long DNS Changes Take).
• Your provider can’t find a record: check for typos. Some DNS editors add your domain to the name by themselves, so enter only the part before it.
• Website form emails go to spam: your single SPF record is missing a sender. Add it.

Still need help?

Open a support ticket in the Client Portal at my.bluearctic.com. Our support page explains how. Include your domain, which provider you’re moving to, screenshots of the records you added, and what you already tried. Never include a password.