TOOLBOX · SECURITY CHECK
Check Microsoft 365.
Is your domain set up cleanly in Microsoft 365? Enter a domain and see whether Microsoft knows a tenant, whether emails run through Exchange Online and whether SPF, DKIM and DMARC match.
WHAT IS CHECKED
One Tenant.
Five Records.
Microsoft 365 only works cleanly with your domain when a few DNS records are set the way Microsoft specifies. We check them from outside, with the values from Microsoft’s documentation. Our glossary explains the basic terms: Microsoft 365, Microsoft Entra ID and Exchange Online.
- 01
Entra Tenant
Does Microsoft know a tenant for your domain? The answer comes from the public sign-in metadata, including the tenant ID. It does not count toward the grade.
- 02
Mail Servers (MX)
Do emails arrive directly at Exchange Online, under mail.protection.outlook.com or the newer target under mx.microsoft? Plus a note on DNSSEC and DANE for incoming emails.
- 03
SPF
Does the SPF record allow Exchange Online with include:spf.protection.outlook.com, also through included records, and does it end with -all, as Microsoft recommends?
- 04
DKIM
Do selector1 and selector2 point to Microsoft as CNAMEs, and can the active key be retrieved? Without DKIM, Exchange Online does not sign your emails with your domain.
- 05
DMARC
Which policy applies to your domain? Microsoft names p=reject as the goal, reached in stages via p=none and p=quarantine.
- 06
Autodiscover
Does autodiscover point to autodiscover.outlook.com? Then Outlook finds mailbox and settings automatically.
HOW WE RATE
Microsoft’s Values.
Clear Weights.
The benchmark is Microsoft’s documentation on Microsoft Learn. Each finding says what to do, often with the DNS record or PowerShell command to copy.
- Weights: DMARC 30 points, SPF and DKIM 25 each, MX and Autodiscover 10 each.
- Critical, grade C at best: no effective DMARC or +all in the SPF record.
- Note: ~all instead of -all, DMARC only with p=none, one DKIM record missing, keys with 1024 bits, other MX besides Exchange Online, Autodiscover missing.
- No grade: if emails do not run through Exchange Online, we give no grade but show what we found.
- For information only: tenant, DNSSEC for incoming emails, DMARC of the onmicrosoft.com domain, Teams federation and Intune enrollment.
- Not in the overall grade: the website security check does not include this check.
Sources on Microsoft Learn: OpenID Connect, External DNS records for Microsoft 365, SPF, DKIM, DMARC, SMTP DANE with DNSSEC and Intune enrollment.
NOT PART OF THIS CHECK
Sign-in and
Tenant Settings.
From outside we only see what Microsoft and your DNS show publicly. Settings in the tenant, users and mailboxes stay hidden.
Managed or Federated?
We do not check whether your users sign in directly to Microsoft Entra ID or through a service of your own such as AD FS: there is no documented public interface for this, and we do not query individual sign-in names. If you still run AD FS, Microsoft recommends moving to cloud authentication (Microsoft Learn).
Settings in the Tenant
Whether multi-factor authentication, conditional access or guest access are configured correctly can only be checked in the tenant itself, with administrator rights.
Email Security in Detail
The email security check rates subdomains and reports in DMARC, the number of SPF lookups, MTA-STS and TLS-RPT, for every mail service.
Open Email Security CheckDNSSEC of Your Domain
The DNS security check tests whether your own zone is signed with DNSSEC, a requirement for the full effect of DANE at Exchange Online.
Open DNS Security Check
Microsoft 365, Microsoft Entra, Exchange Online, Microsoft Teams and Microsoft Intune are trademarks of Microsoft Corporation. This tool is not an offering of Microsoft and only shows information that is publicly available.
NEXT WITH MICROSOFT 365
Finding in Hand.
Implementation Planned.
If you do not want to set the records yourself or are only introducing Microsoft 365, we support you.
QUESTIONS
Good to Know.
What does the Microsoft 365 domain check test?
It queries Microsoft’s public sign-in metadata for your domain and uses it to recognize whether Microsoft assigns a tenant in Microsoft Entra ID to the domain. It also reads public DNS records: whether emails arrive at Exchange Online (MX), whether SPF allows Exchange Online and ends with -all, whether the two DKIM records of Microsoft 365 are set and a key can be retrieved, which DMARC policy applies and whether Autodiscover points to Exchange Online. For information it shows DNSSEC for incoming emails, DMARC of the onmicrosoft.com domain, Teams federation and Intune enrollment.
Can anyone see my tenant ID?
Yes. Microsoft publishes the sign-in metadata of every tenant at a public address because applications need it for sign-in, and also accepts the domain name as an identifier. The metadata contain the tenant ID and technical addresses, but no users, passwords or settings. This check only shows what anyone can retrieve with the domain name anyway.
Why does my domain get no grade?
We only give a grade when emails of the domain run through Exchange Online, recognizable by the MX, the SPF include or Microsoft’s DKIM records. If you use another mail service or no Microsoft 365, any grade would be misleading. You then see whether Microsoft knows a tenant for your domain, and a pointer to the email security check for your actual mail service.
Does the check detect whether sign-in runs through AD FS?
No. Microsoft offers no documented public interface for whether your users sign in directly to Microsoft Entra ID (managed domain) or through a service of your own such as AD FS (federated domain). The known ways are undocumented or query individual sign-in names, and we use neither. If you still run AD FS, Microsoft recommends moving to cloud authentication, preferably with password hash synchronization.
Which data goes to whom, and does TOMORIS store anything?
Our server queries the sign-in metadata for your domain once from Microsoft at login.microsoftonline.com. Microsoft receives the domain name and the address of our server, not your IP address. The DNS queries go through the DNS resolver that our web server uses at the hosting provider. We check no user accounts, sign in nowhere and connect neither to your website nor to your mail server. The result stays in memory for five minutes and is deleted after six minutes at the latest.
How is the grade calculated?
Five checks count: DMARC with 30 points, SPF and DKIM with 25 each, MX and Autodiscover with 10 each. Passed counts in full, a note counts half, a critical finding counts nothing. Without effective DMARC, C is the best possible grade, and the same applies with +all in the SPF record. A+ is only possible without a critical finding. We show the tenant, DNSSEC, the onmicrosoft.com domain, Teams and Intune, but they do not count. This check does not feed into the overall grade of the website security check.
TOOLBOX
More
Tools.
Microsoft 365 Endpoints
Which addresses must your firewall allow for Microsoft 365? Shows URLs, IPv4 and IPv6 ranges by service and category (Optimize, Allow, Default), checked against Microsoft every hour and ready to copy.
ViewEntra ID Error Code Explainer
AADSTS50126, 53003 or 65001? Enter the code and read what is behind the sign-in error and who can fix it. 40 common codes, with a link to Microsoft.
ViewToken Decoder (JWT)
What is in an access token? Read JWT headers and payloads, with claim explanations and expiration in Vienna time. Browser only; signatures are not verified.
View
YOUR NEXT STEP
You Have the Result.
What Comes Next?
We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.