How to Check Whether a Domain Uses Microsoft 365 (Even Behind a Gateway)
To check whether a domain uses Microsoft 365, read four things in DNS: the autodiscover CNAME, the MS=ms TXT record, the MX record and the Teams names. The bulk autodiscover checker reads them for up to 100 domains or email addresses a run (500 after a free Google sign-in) and labels each row. It also finds Microsoft 365 behind a security gateway, which an MX-only lookup misses.
Everything is public DNS. Nothing is sent to Microsoft or to the domains' servers.
The records Microsoft 365 uses
These come from Microsoft's external DNS records for Microsoft 365.
| Record | Normally | Tells you |
|---|---|---|
autodiscover CNAME |
autodiscover.outlook.com |
Outlook sets itself up against Exchange Online |
_autodiscover._tcp SRV |
Microsoft host | Same, by SRV |
TXT MS=ms... |
tenant code | The domain was added to a tenant |
| MX | ...mail.protection.outlook.com |
Mail is delivered to Exchange Online |
lyncdiscover, sip |
Microsoft hosts | Teams or Skype for Business |
enterpriseregistration, enterpriseenrollment |
Microsoft hosts | Intune device sign-up |
Teams and Intune records are optional, so many real tenants do not publish them.
By hand
dig +short CNAME autodiscover.example.com
dig +short MX example.com
dig +short TXT example.com
On Windows, use nslookup -type=cname autodiscover.example.com and the same pattern for MX and TXT. Look for outlook.com, mail.protection.outlook.com and a TXT value starting MS=. That is three lookups a domain by hand, which is why the bulk tool helps for a list.
Step 1: paste the domains
Paste domains or email addresses, one per line. Use up to 100 a run, or 500 after a free Google sign-in.
Step 2: run the check
Each domain gets eight DNS queries, 25 domains a request: autodiscover CNAME and SRV, TXT, MX and the Teams and Intune names.
Step 3: read each row
| Result | What it means |
|---|---|
| Microsoft 365 mail | The MX goes to Exchange Online |
| Microsoft 365 behind another MX | Autodiscover or Teams point to Microsoft, but the MX goes elsewhere, usually a gateway |
| Exchange elsewhere | Autodiscover exists but points to another server |
| Verified only | Just the MS= record: added to a tenant, mail use unproven |
| No Microsoft records | None were found |
Records can outlive their use. A company that moved to Google Workspace may still have an old autodiscover CNAME, so each row lists every record found. Download the CSV and filter by result.
Why the gateway case matters
Most provider lookups read only the MX, so a domain behind Proofpoint looks like Proofpoint, while the mailboxes and the filtering that decides the inbox are often still Microsoft's. Knowing that helps you follow Microsoft's sender requirements. Our guide to verifying emails behind security gateways covers the delivery side, and the bulk email provider lookup covers every provider, not only Microsoft.
What this check cannot do
- It reads published records only. Stale records can remain after a company leaves Microsoft 365.
- It cannot see a tenant's name or licences.
- It does not say whether an address at the domain exists.
- The limit is 100 domains a run without an account and 500 signed in.
Check the addresses on those domains
Knowing a domain runs Microsoft 365 does not tell you which mailboxes exist. Upload your list on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason, and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.
Check your domains now
Paste them into the bulk autodiscover checker.
For a single domain, the free Microsoft 365 email checker gives the same answer.
Common questions
How do I check if a domain uses Microsoft 365?
Look for an autodiscover CNAME to autodiscover.outlook.com, an MX record ending mail.protection.outlook.com and a TXT record starting MS=ms. A bulk autodiscover checker reads these for many domains at once.
Why does the MX not show Microsoft when the company uses Microsoft 365?
A security gateway such as Proofpoint or Mimecast can sit in front of Exchange Online, so the MX names the gateway. The autodiscover and Teams records still point to Microsoft.
What does the MS= TXT record mean?
It proves the domain was added to a Microsoft 365 tenant. On its own it does not show that the domain uses Microsoft for mail.
Can the checker see the company's licences or tenant name?
No. Those are not in DNS.
Can an old autodiscover record be left over?
Yes. A company that moved to another provider may keep the old record, so the checker lists every record found for you to judge.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.