Free Resource Tower CRM

Microsoft 365 Deliverability Checklist

The exact steps to configure M365 for perfect cold email and CRM deliverability — written by a founder who survived it so you don't have to.

Michael Rabin Founder, Tower CRM · CRO at Ramp Revenues

Phase 1: Identity & Domain Setup

Avoid creating a second user. Change the User Principal Name (UPN) of your existing account instead of creating a new one for your custom domain.
In the Microsoft 365 admin portal, navigate to Users → Active Users → [your user] → Manage username and email.
Change the primary email to your custom domain (e.g., michael@tower-crm.com).
CRITICAL: Perform a full sign-out on all devices, clear browser cache and cookies, then log back in with the new UPN.
Verify the primary sign-in address shows your custom domain — not the .onmicrosoft.com fallback.

In your domain registrar's DNS settings, add the MX record pointing to Microsoft's servers (see your M365 DNS setup guide for exact values).
Add the SPF record:
v=spf1 include:spf.protection.outlook.com -all
Verify the MX record is propagated: run nslookup -type=MX yourdomain.com or use mxtoolbox.com.
In the Exchange Admin Center, confirm mail flow is routing through your custom domain (not onmicrosoft).
Navigate to the Exchange Admin Center: If the new Microsoft 365 interface doesn't show it in the sidebar, look for "Classic Exchange Admin Center" under Admin Centers.

Navigate to Security → Email & Collaboration → Policies & Rules → Threat policies → Email authentication settings → DKIM.
Select your custom domain (not the onmicrosoft domain).
Click "Create DKIM keys" and Microsoft will generate two CNAME records for you to add to your DNS.
Add both CNAME records to your domain registrar.
Return to the DKIM page and click "Enable" — wait up to 24 hours for propagation.
Test with mail-tester.com — DKIM should show green.

Add a DMARC TXT record to your DNS:
_dmarc.yourdomain.com → TXT → v=DMARC1; p=none; rua=mailto:you@yourdomain.com
Start with p=none (monitor mode) — don't go to p=reject until SPF and DKIM are confirmed green.
Verify DMARC record propagation at dmarcian.com.

Do not create a personal alias for support@, hello@, etc. — the From Name will not display correctly.
In the Exchange Admin Center, go to Recipients → Shared Mailboxes → Add a shared mailbox.
Set the display name (e.g., "Tower CRM Support") and the email address (e.g., support@yourdomain.com).
Grant your main account Full Access and Send As permissions to the shared mailbox.
In Outlook, add the shared mailbox account — emails sent from it will show the display name you set.