ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 272/272 feeds/APIs · 469/469 docs · 8/9 advisories · checked 09:15 UTC Customize Public modeDiscuss ChangeIntel on Discord
MC1048624 Plan for changeMajor changeUpdated messageAdmin impact

DNS Provisioning Change

Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Exchange Online
Microsoft 365 admin center

Action date

1 Jul 2026 117d ago Act by , as Microsoft's metadata states

Schedule dates changed in the text

Date phrases in schedule sentences differ between the versions this installation saw
  • Seen 2 Feb 2026 February 1st, 2025 → July 1, 2026
  • Seen 2 Oct 2025 February 1st, 2025

Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.

What the notice says

Microsoft’s text, with source markup removed
Updated February 2, 2026: We have updated the timeline. Thank you for your patience.   We’re making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after July 1st, 2026 (previously February 1st). Between early and late July 2026 (previously February), we will gradually switch provisioning of all A records for new Accepted Domains into the new subdomains under mx.microsoft. We are doing this to reduce the friction of adopting DNSSEC in the long run. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS spoofing and adversary-in-the-middle attacks to DNS. How this will affect your organization: After July 1, 2026 (previously February 1), all A records for new Accepted Domains will be provisioned into the new subdomains under mx.microsoft. July 1, 2026 (previously February 1) if not secured with DNSSEC at the domain level (ex. contoso.com), then DNS resolution will work as usual. If an Accepted Domain you add to the EAC after July 1, 2026 (previously February 1) is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft DNS record automatically and you will get the benefits of DNSSEC without having to take any further action. Any issues with DNSSEC can be addressed by disabling DNSSEC for the Accepted Domain (ex. contoso.com) via your DNS provider. What you need to do to prepare: If you have any automation in place, for example in workflows for Domain Setup, for MX record creation that expects A records for newly provisioned Accepted Domains to be provisioned in mail.protection.outlook.com, this automation needs to be updated by July 1, 2026 (previously February 1) to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After July 1, 2026 (previously February 1), List serviceConfigurationRecords Graph API will be the only source of truth for your Accepted Domains’ MX record value. You will not be able to rely on the Accepted Domain’s A record being provisioned in mail.protection.outlook.com after July 1, 2026 (previously February 1). If you are using automation that expects the record to end with mail.protection.outlook.com, when you add a new Accepted Domain to the Exchange Admin Center after July 1, 2026 (previously February 1), mail flow may not work upon initial configuration and you will have to update your MX record to match what the Exchange Admin Center says for the domain or use the mailExchange value returned by List serviceConfigurationRecords Graph API. If you expect this change to cause any issues for your organization, please share that feedback.

What changed

Between archive captures, newest first
    • Act by 1 Feb 2026 → 1 Jul 2026

    Updated OctoberFebruary 2, 2025:2026: We have updated the timeline. Thank you for your patience.   We’re making … DNS provisioning of A records for all new Accepted Domains provisioned after FebruaryJuly 1st, 20252026 (previously OctoberFebruary 1st). Between early and late FebruaryJuly 2026 (previously early October and late October), February), we will gradually switch provisioning of all A records for new Accepted … and adversary-in-the-middle attacks to DNS. How this will affect your organization: After February 1st, 2025July 1, 2026 (previously October 1st),February 1), all A records for new Accepted Domains will be provisioned into the new subdomains under mx.microsoft.February 1st, 2025mx.microsoft. July 1, 2026 (previously October 1st) isFebruary 1) if not secured with DNSSEC at the domain level (ex. contoso.com), then DNS … as usual. If an Accepted Domain you add to the EAC after February 1st, 2025July 1, 2026 (previously October 1st)February 1) is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft DNS … to be provisioned in mail.protection.outlook.com, this automation needs to be updated by February 1st, 2025July 1, 2026 (previously October 1st)February 1) to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After February 1st, 2025July 1, 2026 (previously October 1st),February 1), List serviceConfigurationRecords Graph API will be the only source of truth for … rely on the Accepted Domain’s A record being provisioned in mail.protection.outlook.com after February 1st, 2025July 1, 2026 (previously October 1st).February 1). If you are using automation that expects the record to end with … you add a new Accepted Domain to the Exchange Admin Center after February 1st, 2025July 1, 2026 (previously October 1st),February 1), mail flow may not work upon initial configuration and you will have …

    • Act by 1 Jul 2025 → 1 Feb 2026

    Updated August 22,October 2, 2025: We have updated the content.timeline. Thank you for your patience.   We’re making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after OctoberFebruary 1st, 2025 (previously AugustOctober 1st). Between early and late October 2025February 2026 (previously early AugustOctober and late August),October), we will gradually switch provisioning of all A records for new Accepted … and adversary-in-the-middle attacks to DNS. How this will affect your organization: After OctoberFebruary 1st, 2025 (previously AugustOctober 1st), all A records for new Accepted Domains will be provisioned into the new subdomains under mx.microsoft. DNS resolution will safely fallback to “plain” DNS if a domain is not DNSSEC enabled. If an Accepted Domain you add to the Exchange Admin Center after mx.microsoft.February 1st, 2025 (previously October 1st (previously August 1st) is not secured with DNSSEC at the domain level (ex. contoso.com), … as usual. If an Accepted Domain you add to the EAC after October 1stFebruary 1st, 2025 (previously AugustOctober 1st) is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft … to be provisioned in mail.protection.outlook.com, this automation needs to be updated by October 1stFebruary 1st, 2025 (previously AugustOctober 1st) to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After October 1stFebruary 1st, 2025 (previously AugustOctober 1st), List serviceConfigurationRecords Graph API will be the only source of truth … rely on the Accepted Domain’s A record being provisioned in mail.protection.outlook.com after October 1stFebruary 1st, 2025 (previously August 1st.October 1st). If you are using automation that expects the record to end with … you add a new Accepted Domain to the Exchange Admin Center after October 1stFebruary 1st, 2025 (previously AugustOctober 1st), mail flow may not work upon initial configuration and you will …

  3. Updated August 6,22, 2025: We have updated the timeline.content. Thank you for your patience.    We’re making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after AugustOctober 1st, 2025.2025 (previously August 1st). Between early August and late August,October 2025 (previously July 1stearly August and August 1st,late August), we will gradually switch provisioning of all A records for new Accepted … and adversary-in-the-middle attacks to DNS. How this will affect your organization: After AugustOctober 1st, 2025,2025 (previously August 1st), all A records for new Accepted Domains will be provisioned into the … If an Accepted Domain you add to the Exchange Admin Center after October 1st (previously August 1st1st) is not secured with DNSSEC at the domain level (ex. contoso.com), then … as usual. If an Accepted Domain you add to the EAC after October 1st (previously August 1st1st) is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft DNS … to be provisioned in mail.protection.outlook.com, this automation needs to be updated by October 1st (previously August 1st1st) to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After October 1st (previously August 1st,1st), List serviceConfigurationRecords Graph API will be the only source of truth for … rely on the Accepted Domain’s A record being provisioned in mail.protection.outlook.com after October 1st (previously August 1st. If you are using automation that expects the record to … you add a new Accepted Domain to the Exchange Admin Center after October 1st (previously August 1st,1st), mail flow may not work upon initial configuration and you will have …

    • Tags Admin impact → Updated message, Admin impact

    Updated August 6, 2025: We have updated the timeline. Thank you for your patience. We’re making some changes to DNS provisioning of A records for all new Accepted Domains provisioned after JulyAugust 1st, 2025. Between early August and late August, 2025 (previously July 1st and August 1st, 2025, we will gradually switch provisioning of all A records for new Accepted … adversary-in-the-middle attacks to DNS. How this will affect your organization: After August 1st1st, 2025, all A records for new Accepted Domains will be provisioned into … If an Accepted Domain you add to the Exchange Admin Center after JulyAugust 1st is not secured with DNSSEC at the domain level (ex. contoso.com), … as usual. If an Accepted Domain you add to the EAC after JulyAugust 1st is secured with DNSSEC, then DNSSEC will extend to the mx.microsoft … to be provisioned in mail.protection.outlook.com, this automation needs to be updated by JulyAugust 1st to use List serviceConfigurationRecords Graph API (List serviceConfigurationRecords). Use List serviceConfigurationRecords to retrieve the mailExchange value for your MX record. After JulyAugust 1st, List serviceConfigurationRecords Graph API will be the only source of truth … rely on the Accepted Domain’s A record being provisioned in mail.protection.outlook.com after JulyAugust 1st. If you are using automation that expects the record to end … you add a new Accepted Domain to the Exchange Admin Center after JulyAugust 1st, mail flow may not work upon initial configuration and you will …

  5. · first version seen

Linked documentation

Microsoft pages the notice links to

The notice links to no Microsoft Learn or Support page that this installation reads.

No related evidence found in this installation's recent collection. This does not establish that no announcement exists.

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 26 Oct 09:15 UTC · 272 of 272 readable · 270 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.