[email protected]:~$

BUILD GUIDE

A step-by-step guide to domain, DNS, and Microsoft 365 email setup.

← Back to the Microsoft 365 project overview

OVERVIEW

This walkthrough follows the sysadmin.solutions project: a domain bought directly through Cloudflare, with DNS managed in Cloudflare and email and identity hosted by Microsoft 365.

The instructions cover Microsoft 365 domain verification, Exchange Online, SPF, DKIM, DMARC, and account sign-in security. Domain-specific values are intentionally omitted.

ARCHITECTURE 

Cloudflare Registrar (domain)
          │
          ▼
Cloudflare DNS (mail records)
          │
          ▼
Microsoft 365
   ├── Exchange Online (email)
   └── Entra ID (identity)

01 — PURCHASE THE DOMAIN THROUGH CLOUDFLARE

Purchase your domain directly from Cloudflare Registrar, as in this project.

  1. Sign in to Cloudflare and open Domain Registration.
  2. Search for an available domain and complete the purchase.
  3. Confirm the domain appears in your Cloudflare account and check the registration contact information.
  4. Enable strong authentication on the Cloudflare account and review renewal settings.

Note: Because this domain was purchased through Cloudflare, no transfer from another registrar or manual nameserver migration was required.

02 — REVIEW CLOUDFLARE DNS

Cloudflare provides authoritative DNS for the domain.

  1. Open the domain in Cloudflare and select DNS → Records.
  2. Review the existing records before adding Microsoft 365 records.
  3. Keep email-related DNS records set to DNS only; do not proxy MX records or Autodiscover.
  4. Leave unrelated website DNS records intact.

Note: DNS changes are made in the Cloudflare dashboard for the domain.

03 — SET UP MICROSOFT 365

Microsoft 365 supplies the Exchange Online email and Entra ID identity services.

  1. Create or sign in to the Microsoft 365 organization (tenant).
  2. Create the initial administrator account and secure it with multifactor authentication.
  3. Open the Microsoft 365 admin center and locate Settings → Domains.
  4. Confirm the needed Exchange Online license is available.

Note: The Microsoft 365 organization is ready to accept a custom domain.

04 — VERIFY THE CUSTOM DOMAIN

Tell Microsoft 365 that you own the domain by completing DNS verification.

  1. In the Microsoft 365 admin center, open Settings → Domains → Add domain.
  2. Enter the Cloudflare-registered domain.
  3. Copy the TXT verification name and value shown for your domain by Microsoft.
  4. In Cloudflare DNS, create the TXT record with those exact values.
  5. Return to Microsoft 365 and select Verify after DNS has updated.

Note: Never publish your actual verification value in a public walkthrough. Follow the values provided by Microsoft for your domain.

05 — CONFIGURE MAIL DNS

Create the DNS records Microsoft 365 provides for Exchange Online.

  1. In Microsoft 365 domain setup, identify the required MX, Autodiscover CNAME, and SPF TXT records.
  2. In Cloudflare DNS, create or update the MX record and its priority to the Microsoft-provided destination.
  3. Create the Autodiscover CNAME record and leave it DNS only.
  4. Add the SPF TXT record authorizing your real sending services; for a Microsoft-only environment, Microsoft supplies the appropriate value.
  5. Check for an existing SPF record: combine authorized senders into one SPF TXT record rather than creating multiple SPF records.
  6. Save each record and confirm Microsoft 365 recognizes the DNS configuration.

Note: Use Microsoft 365’s domain-specific record values rather than copying record targets from another organization.

06 — CONFIGURE EXCHANGE ONLINE

Create a licensed mailbox using the custom email domain.

  1. In Microsoft 365, create the required user or open an existing user.
  2. Assign an Exchange Online license (this project used Exchange Online Plan 1).
  3. Confirm the mailbox is created and the correct custom-domain address is assigned.
  4. In Exchange admin center, configure any required secondary email aliases.
  5. If sending from an alias is needed, separately verify that the applicable Exchange organization setting and client support it.

Note: Exchange Online hosts the mailbox and transports mail; no self-hosted SMTP server is required.

07 — ENABLE DKIM

DKIM signs outgoing mail so recipients can verify it was authorized by the domain.

  1. Open the DKIM settings for the custom domain in Microsoft 365 Defender or the relevant Exchange email authentication area.
  2. Copy the two selector CNAME names and targets Microsoft provides.
  3. Create both CNAME records in Cloudflare DNS as DNS only.
  4. After DNS updates, return to Microsoft 365 and enable DKIM for the domain.
  5. Confirm DKIM reports as enabled and test a newly sent message.

Note: Selector CNAME targets are tenant-specific. Always obtain them from Microsoft 365.

08 — CONFIGURE DMARC

DMARC tells recipients how to handle messages that fail aligned SPF or DKIM checks and can provide reporting.

  1. In Cloudflare DNS, create a TXT record at _dmarc for the domain.
  2. Start with a monitoring policy if you need to observe legitimate senders before enforcing stricter handling.
  3. Configure an aggregate report destination only if you control the receiving mailbox or reporting service.
  4. Check DMARC syntax and review reports before moving to quarantine or reject.

Note: DMARC policies depend on all services that send email for the domain. Do not claim that a passing SPF or DKIM check alone guarantees inbox delivery.

09 — SECURE IDENTITY AND SIGN-IN

Use Microsoft Entra ID security controls to protect the admin and mailbox accounts.

  1. Confirm Microsoft Security Defaults are enabled, if that is the security approach used by your tenant.
  2. Register Microsoft Authenticator as a sign-in method and complete the prompts.
  3. Register a passkey where supported and verify it works for the intended account.
  4. Test a fresh sign-in to verify the additional sign-in method is available or requested as expected.
  5. Review Entra sign-in logs after testing and keep recovery methods protected.

Note: Security Defaults do not necessarily trigger MFA on every sign-in. Requiring particular authentication methods at each sign-in may need other licensing and Conditional Access configuration.

10 — VALIDATE EMAIL AND SECURITY

Confirm the finished environment works before calling the project complete.

  1. Send and receive email between the custom-domain mailbox and an external provider.
  2. Inspect the authentication results in a received message and check SPF, DKIM, and DMARC outcomes.
  3. Confirm the mailbox address and any required aliases work as intended.
  4. Confirm Microsoft 365 domain status is healthy.
  5. Test authorized sign-in and review security notifications or sign-in logs.

Note: This project overview documents successful email delivery, SPF/DKIM/DMARC checks, and MFA verification; results in another environment should be validated independently.

← Project overview Home

SYSTEM STATUS: ONLINE