The records Exchange Online needs
Microsoft documents three main DNS records for email. The Autodiscover alias lets Outlook find the service. The MX record sends your mail to Exchange Online, using a name built from a token shown in your admin console followed by mail.protection.outlook.com, with a preference lower than any other MX record. The SPF record, one TXT record, lists the servers allowed to send as your domain and normally contains include:spf.protection.outlook.com. Take your values from your own console.
- One SPF record only, and no more than 10 lookups in total.
- Remove the old system's MX once mail is flowing.
Switching MX is all or nothing
Microsoft says that when you change the domain's MX record, all email sent to the domain starts coming to Microsoft 365. In our reading, mailboxes should therefore exist first. For a gradual start, Microsoft documents a way to pilot with a few addresses on your custom domain. This is why a move needs a plan, a final sync, a check for mail that arrived late and both providers left alone for a while.
Forwarding is a policy, not just a rule
Whether a mailbox can forward mail to an outside address is controlled by the outbound spam filter policy. It has an on setting, an off setting and a system-controlled default whose behaviour Microsoft says differs between organisations and recommends replacing with an explicit choice. When forwarding is off, the sender receives a non-delivery report with 5.7.520. This is the usual reason forwarding to a personal address "stopped working". An alias, group or shared mailbox inside the tenant avoids the question.
Migration limits to know
For migrations into Microsoft 365, users must be provisioned as mail-enabled before the copy, and the default largest message that can be migrated is 35 MB. Microsoft warns that retention and archive policies can make migrated items look missing, and recommends disabling them first. Calendars and contacts can be included, but a mail-only plan keeps the scope and the checks small.
Where our jobs fit
Each is a published test price, not yet tested with buyers, payable after sign-off. The cPanel mailbox move is £295, the Google Workspace mailbox move £395, the mail routing repair £175, the forwarding repair £165 and the sender-authentication job £195. Licences, the tenant and the user mailboxes are yours to provide, and we never need your admin password by ordinary email.
Sources and limits
- Microsoft 365: external DNS records Checked 2026-10-11.
- Email needs an Autodiscover CNAME, an MX record with a preference lower than any other, and a single SPF record that allows spf.protection.outlook.com; changing MX sends all mail to Microsoft 365.
- You can have only one SPF record and its lookups cannot exceed 10.
- Microsoft: Control external email forwarding and fix 5.7.520 errors Checked 2026-10-11.
- Automatic external forwarding is controlled by the outbound spam filter policy, whose system-controlled default differs by organisation, and a block returns 5.7.520.
- Microsoft: Perform a Google Workspace migration to Microsoft 365 Checked 2026-10-11.
- Users must be provisioned first, the default largest migrated message is 35 MB, and retention or archive policies can make items look missing.