What this check looks at
Checks that the tenant has at least one verified custom domain set as default.
Every tenant starts with an initial domain, name.onmicrosoft.com, which cannot be removed. Organisations normally add and verify their own domain (for example example.co.uk) by publishing a DNS record, then make it the default so new accounts and email addresses use it.
This check reads the tenant’s verified domains. It passes when a custom domain is verified and set as default, and warns when a custom domain is verified but the default is still the onmicrosoft.com domain. The check fails when no custom domain is verified at all, so the tenant runs entirely on onmicrosoft.com.
Mail from an onmicrosoft.com address looks unfinished and is easy to imitate: anyone can create another tenant with a similar onmicrosoft.com name, and recipients cannot tell them apart. The organisation also cannot publish its own SPF, DKIM and DMARC for onmicrosoft.com, and Microsoft limits how much external mail onmicrosoft.com addresses can send, so it has no control over its email reputation.
Why it matters
Operating on the default .onmicrosoft.com domain signals an unfinished deployment, harms deliverability, and makes phishing that impersonates the organisation harder for recipients to spot.
A typical case: a small charity has run on charityname.onmicrosoft.com since a volunteer set it up. Donors receive genuine receipts from an onmicrosoft.com address, so when fraudsters create a lookalike tenant and send updated bank details, donors have no way to tell the difference, and gifts go to the wrong account.
Adding a domain takes minutes once someone has DNS access, and it brings proper email authentication, an address customers already recognise, and cleaner sign-in names.
ISO 27001 A.8.9 (configuration management) and the NCSC 10 Steps architecture and configuration guidance expect services to be set up properly and documented. The NCSC’s email security guidance assumes the organisation controls its own sending domain, with SPF, DKIM and DMARC published.
How to fix it
Where: Microsoft 365 admin centre → Settings → Domains
Before you start
- Add the TXT record Microsoft gives you at the domain’s DNS host, then verify.
Step by step
- Add the domain. In the Microsoft 365 admin centre go to Settings > Domains > Add domain, enter the organisation’s domain and continue, choosing to verify with a TXT record.
- Publish the verification record. Add the TXT record Microsoft shows (MS=ms followed by a number) at the domain’s DNS host, wait until it is visible, and select Verify. If the DNS host supports it, Microsoft can add the records for you.
- Add the mail records. Let the wizard show the DNS records for Exchange Online (MX and the autodiscover CNAME) and the SPF record (v=spf1 include:spf.protection.outlook.com -all). If mail currently goes elsewhere, plan the MX change for a quiet time, then add the records.
- Make it the default. Back in Settings > Domains, select the domain and choose Set as default. New users and groups now get addresses on it.
- Move existing users to the new domain. For each existing user, change the username and primary email address to the new domain (Users > Active users > the user > Manage username and email), or in Microsoft Graph PowerShell: Update-MgUser -UserId <old upn> -UserPrincipalName <new upn>. Tell users their sign-in name has changed; the old address stays as an alias.
- Turn on DKIM and publish DMARC. In the Microsoft Defender portal, Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM, publish the two CNAME records shown for the domain and enable signing. Publish a DMARC TXT record at _dmarc (for example v=DMARC1; p=none; rua=mailto:<reporting address>) and move it to quarantine or reject once the reports are clean.
- Confirm the domain is in use. Settings > Domains should show the domain as healthy and default. Send a message to an external address and check the headers show SPF, DKIM and DMARC passing. The finding clears at the next assessment.
What users will notice
Users can be given addresses on the company domain instead of onmicrosoft.com.
How to confirm it worked
Microsoft 365 admin centre, Settings, Domains: the domain is Verified and set as default.
Frameworks and controls
This check maps to controls in 2 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| ISO 27001:2022 | A.8.9 Configuration management |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Add a domain (Microsoft Learn)