MX record change Needs advise

[Devaraj G]

Hi Team,

We have recently completed the migration from exchange 2013 to office 365. And now 95 %  of mailboxes are in office 365. However, our MX record is still pointed to on-prem spam filter, we need to change this to EOP Mx record to route all inboud emails to office 365.

Apart from TXT record, i havent verified any records in office 365. Could you advise what other records i need to change apart from MX and i guess we need to create all the CNAMES in external and internal DNS servers ? like autodiscover etc ?

is there any other consideration i need to look for during the MX record change. I hope there is no impact to mail flow during the change.

Please advise.

[#2]

Before you make any changes, you need to determine how your outbound email routing will be done.  Will you route all outbound messages for your remaining on-premises mailboxes directly out to the Internet from your on-premises Exchange environment or will you route all outbound messages through EOP?  This doesn't necessarily impact your MX record, but rather your SPF record.

Refer to Office 365 Admin Portal > Setup > Domains > DomainName to see what the DNS record values are that would be required for EOL (MX, SPF and Autodiscover).

If you want outbound email for your remaining on-premises mailboxes to route through EOP, you will need to make sure your outbound connector is configured correctly to route all outbound through a smarthost location of EOP.  In this case, your SPF record will be exactly what is displayed in the O365 Admin Portal (i.e. v=spf1 include:spf.protection.outlook.com -all).

If you want your remaining on-premises mailboxes to route directly out to the Internet, then your SPF will be slightly different.  This will be based on whether you use your IP address or if you have a public DNS name and a matching certificate for TLS setup for your on-premises environment.  For example, if you wanted to include the IP address of 10.64.136.21 as your outbound IP address and the hostname of mail.domain.com, your SPF record would look something like this:

v=spf1 a:mail.domain.com ip4:10.64.136.21 include:spf.protection.outlook.com -all

Autodiscover should be fine pointing to either on-premises or EOL assuming your hybrid environment is configured correctly.  I would typically recommend having this point to EOL instead as it would seem that is your end-state anyways.

These are the only DNS records that would be required, but the O365 Admin Portal will show you additional records you may want for other functionality as well.

As far as a mail outage during these changes, update your SPF first and give it time to replicate.  This will avoid spam filtering from potentially blocking outbound messages due to replication delays.  After the MX is changed, again with the correct hybrid configuration, you shouldn't see any interruptions as message that get routed on-premises first should still be forward up to EOL until global DNS replication is complete.

[#3]

Hi Christopher,

Thank you so much for the details.

I have already appended spf.protection.outlook.com to my existing SPF record. Should this be fine ?

I havent configiured centralized hub trasport for email during the hybrid configuration. Yes, i need to route internal mailbox emails to EOP. Only two mailboxes are in on-prem.

6 CNAMES missing - are showing in the office 365 portal including autodiscover. Hope after the MX change outlook clients will not have any impact.

it there any time period to to allow for MX record to get update after the change. Any mail queue possible ? 

Thank you for the support.

[#4]

Hi Devaraj,

Is advised to create all CNAMES records that the services you will need depending on the workloads that you are using.

The change of MX depends on your TTL on the original record, that's the time that you could have to wait to replication changes.

If you change the autodiscover record your on-premises user are unable to use autodiscover.

[#5]

Thank you for the update .

So shall I leave the auto discover as it is ?? I don’t want any impact to the users,.

[#6 · Accepted solution]

Hi Devaraj,

If you need to the users to use autodiscover you need to maintain the record pointed to on-premises exchange.