Verifying a domain in Microsoft 365 without touching your mail

Adding your own domain to a Microsoft 365 tenant is a prerequisite for directory synchronisation, and it is the step people put off — because it looks like the moment mail moves, and mail is the thing you cannot afford to break.

It is not that moment. But the wizard does offer to make it that moment, in the same flow, a couple of clicks later.

What verification actually is

Microsoft needs proof that the domain is yours. The proof is a TXT record — something like MS=ms78050355 — published in your DNS.

That record does nothing else. It routes nothing, redirects nothing, and no mail system consults it. Publishing it is as consequential as writing your name on a piece of paper.

The steps

Step 4 is the whole point of this chapter.

Set it as default

Once verified, set the domain as the tenant default. This affects what new accounts get as their primary address: without it, users created in the tenant are born as @tenant.onmicrosoft.com.

It costs one click and saves correcting a batch of accounts later.

Why this has to happen before synchronisation

Directory sync copies each user’s UPN from the on-premises directory into Entra ID. If the tenant cannot verify the domain in that UPN, it does not accept it — the account is created with @tenant.onmicrosoft.com instead.

So the order is fixed:

Getting the order wrong is recoverable, but it means going back over every account that was already synchronised.

What the DNS looks like at the end of this chapter

Nothing has changed except one added record:

Record	State
TXT MS=…	added — the verification
MX	untouched — mail still goes where it went
CNAME autodiscover	untouched
TXT SPF	untouched
Everything else	untouched