Your own domain for Google Workspace and Microsoft 365Verification, MX, SPF and DKIM - which records to set where

Published on October 20, 2026

What you need

The same principle applies to both services: the mailboxes are at Google or Microsoft, the domain and its DNS management are with you. Via DNS records, you tell the world who accepts mails for your domain and who may send on its behalf.

So you need a domain on which you can set MX, TXT and CNAME records yourself. With us, that comes with every domain. You do not need a website or web hosting for this.

Which record types exist and how the TTL works is explained in DNS records explained. The basics of MX, SPF, DKIM and DMARC are in Use a domain for email - here, it is about the concrete values of the two big providers.

The right order

1. Plan for time. With us, DNS records have a fixed TTL of 24 hours. A changed MX can therefore take up to a day until all mail servers know it - the old mailbox must remain reachable for that long. If DNS is still with another provider, lower the TTL there a day or two beforehand.
2. Verify the domain. Both services require a TXT record as proof of ownership. It does not change anything about the mail flow yet.
3. Create mailboxes and take over existing mails.
4. Switch the MX. Only now do new mails land at the new provider. Remove old MX records completely.
5. Set SPF, DKIM and DMARC so that your outgoing mails do not land in spam.

If you switch the MX records before creating the mailboxes, you lose mails in the meantime. This is why this order matters more than any individual value.

Google Workspace: the records

In our web interface, enter @ for the domain itself in the subdomain field for all records, and google._domainkey for the DKIM record. Google works with a single MX record today, and our web interface also provides exactly one MX record per name. It sets the priority automatically - Google specifies priority 1, but with only one record the value does not matter. You do not need older guides with five records (ASPMX.L.GOOGLE.COM and the ALT servers).

You generate the DKIM key in the Admin console in the Gmail section under "Authenticate email". After entering it, you start the authentication there. Google states up to 72 hours for new MX records to propagate; it is usually much faster.

Microsoft 365: the records

Microsoft generates the MX value individually for every domain - copy it exactly from the admin center under "Domains". Our web interface sets the priority automatically; with a single MX record, it has no significance. The autodiscover record ensures that Outlook and mobile devices find the mailbox automatically. You switch on DKIM in the Microsoft Defender portal after setting the two CNAME records.

SPF and DMARC: the most common mistakes

• Only one SPF record per domain. If another service sends mails besides Google or Microsoft - a newsletter tool or your web hosting - all include: entries go into the same record. Two SPF records make both invalid.
• Start DMARC gently. A TXT record on _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com initially only collects reports. Only once SPF and DKIM pass cleanly do you tighten to quarantine or reject.
• Leaving old MX records in place. Then the inbox is split between two providers, and mails seem to turn up randomly here and there.

Combine web hosting and an external mailbox

You can run the website on web hosting and the mails at Google or Microsoft. Then the A record and www point to the web hosting, the MX records to the mail provider.

If the domain is set up in the web hosting, switch off the mail service for this domain there. Otherwise, the web hosting continues to consider itself responsible and delivers mails sent, for example, by a contact form on the same server locally - they never arrive in the external mailbox. Connecting domain and web hosting is explained in Connect a domain to your web hosting.

Frequently asked questions