Which domain and sending routes are in scope?
Start with the address your clients see, not the name of your subscription. Microsoft's documentation distinguishes its own onmicrosoft.com routing domains from a customer's custom domain. Ask which of your domains and subdomains actually send mail and who controls their public DNS records. Source
List routes outside Outlook: appointment reminders, website notifications or marketing services, where used. These examples are not assumptions about your setup.
What should the administrator confirm about DKIM?
Microsoft's current custom-domain guidance requires two DKIM CNAME records and an enabled signing state. It introduced a changed target format for new custom domains in May 2025. Use the exact values shown for your domain in the supported administrator tools; do not construct them from an old tutorial or another company's example. Source
Keep a dated note of the records, signing state and custom-domain test message with your change records. This makes the work reviewable without exporting credentials or private signing material.
What belongs beside the Microsoft settings?
The sender inventory belongs beside them. Microsoft recommends reviewing non-Microsoft mail sources as part of authentication setup. A supplier's ability to send email is not the same as correct authentication using your visible business domain. Have the administrator identify how each approved service is configured and tested. Source
Assign each service a business owner to confirm its use and produce a harmless test message. The administrator interprets the result instead of guessing which integrations remain important.
How should a change be handed over?
Request a short record with the domain, approved scope, before-and-after values, test results, and unresolved exceptions. Keep account protection separate: multi-factor authentication and administrator access controls address a different question from published sending policy. Neither workstream should disappear because the other received a passing result.
For a provider migration or a new bulk sender, agree the test plan before the cutover. Name the messages the business cannot afford to overlook, the person who will check them, and the response if they fail. This is a practical preparation step, not a promise of uninterrupted delivery.
- Which custom domains and subdomains were checked?
- Are both Microsoft DKIM records present and signing verified?
- Which non-Microsoft senders were included?
- Who approves and records subsequent changes?
What should you send when requesting a review?
Send your business domain, say that you use Microsoft 365, and name the person who manages it. Include a list of sending tools if available. Do not send an administrator password, recovery code, private key, or customer message merely to begin a public-record review.