Domains

This page lists the domains registered in the selected tenant and lets you add, verify, and remove them, along with showing the DNS records Microsoft expects for each one.

Page Actions

Add Domain opens a drawer asking only for a Domain Name. Adding a domain registers it with the tenant in an unverified state; it becomes usable once ownership has been proven. The drawer stays open after a successful add so several domains can be registered in one sitting.

Proving domain ownership

A domain is unverified until Microsoft can see a record it asked for in that domain's public DNS, which demonstrates that whoever added it controls the domain. You will need access to wherever the domain's DNS is hosted, usually the registrar or a DNS provider such as Cloudflare or Route 53. Until this is done the domain cannot be used for mail, sign-in or anything else.

1

Add the domain

Enter the domain name in the Add Domain drawer and add it. It appears in the table straight away with Is Verified unticked.

2

Collect the verification record

Open the row's More Info flyout and look at Verification Records, or start Verify Domain, which shows the same records in its confirmation dialogue. Microsoft usually asks for a TXT record whose value begins MS=ms, and sometimes offers an MX record as an alternative. Where more than one record is offered, any one of them is enough. Each value has a copy button next to it.

3

Publish the record in DNS

Create the record at the root of the domain, using the host or name your DNS provider uses for the domain itself, often written as @ or left blank. Copy the value exactly as shown. The TTL given alongside the record is a suggestion rather than a requirement; a low value such as 300 seconds makes the record visible sooner.

4

Verify in CIPP

Once the record has propagated, run Verify Domain on the row. Propagation is usually a few minutes but can take longer, and verification fails rather than retrying if the record is not yet visible, so simply run it again after waiting.

Verification proves ownership only. It does not configure the domain for any service. Once verified, use Service Configuration Records in the row's flyout to see the MX, SPF, autodiscover and other records Microsoft expects for the services the domain will be used with.

Table Details

The properties returned are for the Graph resource type domain. For more information on the properties please see the Graph documentation.

The domain name itself appears in the Id column, since that is the identifier Microsoft uses for a domain.

Table Actions

Action	Description	Bulk Action Available
Verify Domain	Asks Microsoft to check for the ownership record and marks the domain verified once it is found. The confirmation shows the records that satisfy verification, so they can be copied without leaving the dialogue. Only offered for domains that are not yet verified.
Set as Default	Makes the selected domain the tenant's default, which is the domain used when no other is specified for new mailboxes and accounts. Only offered for verified domains that are not already the default.
Delete Domain	Removes the domain from the tenant. Only offered for domains that are neither the default nor the tenant's initial onmicrosoft.com domain, neither of which can be removed.
More Info	Opens the Extended Info flyout with the full details for the selected row.

Verification only succeeds once the record has been published and has propagated. Running Verify Domain before then returns an error rather than queuing a retry, so publish the record first and verify afterwards.

Extended Info Flyout

The flyout for this table is built specifically for domains and shows three sections:

• Supported Services, the Microsoft services the domain is enabled for, such as Email or OfficeCommunicationsOnline.

• Verification Records, the DNS records that prove ownership. Each is headed by its name and record type, with its TTL and whether it is optional, and every value carries a copy button.

• Service Configuration Records, the DNS records Microsoft expects for the services the domain is used with, such as MX, autodiscover and SPF. These are shown the same way, with an additional label naming the service each record belongs to.

Both record sets are read live from Microsoft when the flyout is opened, so they reflect what Microsoft is currently asking for rather than a cached copy.

---

Feature Requests / Ideas

We value your feedback and ideas. Please raise any feature requests on GitHub.