๐ Secure Bits ๐ก
๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ ๐ถ๐ ๐ฐ๐ต๐ฎ๐ป๐ด๐ถ๐ป๐ด ๐ ๐ซ ๐ฟ๐ฒ๐ฐ๐ผ๐ฟ๐ฑ๐ ๐ถ๐ป ๐๐
๐ฐ๐ต๐ฎ๐ป๐ด๐ฒ ๐ข๐ป๐น๐ถ๐ป๐ฒ (๐๐๐น๐ ๐ฎ๐ฌ๐ฎ๐ฒ) โ ๐ฎ๐ป๐ฑ ๐ถ๐ ๐๐ป๐น๐ผ๐ฐ๐ธ๐ ๐๐๐ฟ๐ผ๐ป๐ด๐ฒ๐ฟ ๐ฒ๐บ๐ฎ๐ถ๐น ๐๐ฒ๐ฐ๐๐ฟ๐ถ๐๐.
A change coming to Exchange Online in ๐ July 2026 will modify how new accepted domains receive their MX records. Instead of the traditional \*.๐ฎ๐ข๐ช๐ญ.๐ฑ๐ณ๐ฐ๐ต๐ฆ๐ค๐ต๐ช๐ฐ๐ฏ.๐ฐ๐ถ๐ต๐ญ๐ฐ๐ฐ๐ฌ.๐ค๐ฐ๐ฎ, Microsoft will start provisioning MX records under \*.๐ฎ๐น.๐ฎ๐ช๐ค๐ณ๐ฐ๐ด๐ฐ๐ง๐ต.
At first glance this looks like a simple DNS change. In reality, itโs a foundational step toward ๐ฝ๐ฟ๐ผ๐ฝ๐ฒ๐ฟ ๐๐ก๐ฆ๐ฆ๐๐ ๐๐ฟ๐๐๐ ๐ฐ๐ต๐ฎ๐ถ๐ป๐ ๐ฎ๐ป๐ฑ ๐ฏ๐ฟ๐ผ๐ฎ๐ฑ๐ฒ๐ฟ ๐ฆ๐ ๐ง๐ฃ ๐๐๐ก๐ ๐ฎ๐ฑ๐ผ๐ฝ๐๐ถ๐ผ๐ป ๐ถ๐ป ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ ๐ฏ๐ฒ๐ฑ.
๐ค ๐ช๐ต๐ ๐๐ต๐ถ๐ ๐บ๐ฎ๐๐๐ฒ๐ฟ๐
This change is primarily about security architecture, not routing. The legacy MX namespace has historically made it difficult to establish a clean DNSSEC trust chain into Microsoftโs mail infrastructure. With the new namespace, Microsoft can better support ๐ฆ๐ ๐ง๐ฃ ๐๐๐ก๐ ๐๐ฎ๐น๐ถ๐ฑ๐ฎ๐๐ถ๐ผ๐ป and authenticated TLS between mail servers.
In practice this enables:
– MX endpoints aligned with DNSSEC-enabled infrastructure
– Improved support for TLSA records used by SMTP DANE
– Stronger validation of server identity during SMTP TLS negotiation
๐ ๏ธ ๐ช๐ต๐ฎ๐ ๐ฑ๐ผ๐ฒ๐ ๐ถ๐ ๐ฑ๐ผ
Most email on the internet still relies on opportunistic TLS, which encrypts traffic but does not strongly authenticate the destination server.
This leaves a gap where DNS manipulation or certificate attacks could theoretically downgrade or intercept mail delivery.
Technologies like ๐๐ก๐ฆ๐ฆ๐๐ ๐ฎ๐ป๐ฑ ๐ฆ๐ ๐ง๐ฃ ๐๐๐ก๐ help close that gap by:
– cryptographically validating DNS responses
– publishing TLS expectations via DNS
– ensuring mail servers connect only to verified infrastructure
๐๐ก๐ฆ๐ฆ๐๐ ๐ฝ๐ฟ๐ผ๐๐ฒ๐ฐ๐๐ ๐๐ก๐ฆ ๐ฟ๐ฒ๐๐ฝ๐ผ๐ป๐๐ฒ๐ ๐ณ๐ฟ๐ผ๐บ ๐๐ฝ๐ผ๐ผ๐ณ๐ถ๐ป๐ด, while SMTP DANE uses DNSSEC-protected TLSA records to authenticate the receiving server and ๐ฝ๐ฟ๐ฒ๐๐ฒ๐ป๐ ๐ฑ๐ผ๐๐ป๐ด๐ฟ๐ฎ๐ฑ๐ฒ ๐ผ๐ฟ ๐บ๐ฎ๐ป-๐ถ๐ป-๐๐ต๐ฒ-๐บ๐ถ๐ฑ๐ฑ๐น๐ฒ ๐ฎ๐๐๐ฎ๐ฐ๐ธ๐.
The new ๐บ๐ .๐บ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ namespace makes it easier for Microsoft to build a complete DNSSEC trust chain into Exchange Online, strengthening end-to-end mail transport security.
๐ ๏ธ What admins should do
Most tenants ๐ฅ๐ฐ๐ฏโ๐ต ๐ฏ๐ฆ๐ฆ๐ฅ ๐ต๐ฐ ๐ต๐ข๐ฌ๐ฆ ๐ช๐ฎ๐ฎ๐ฆ๐ฅ๐ช๐ข๐ต๐ฆ ๐ข๐ค๐ต๐ช๐ฐ๐ฏ, but this is a good opportunity to review and strengthen email transport security.
๐ก๏ธ ๐ฅ๐ฒ๐ฐ๐ผ๐บ๐บ๐ฒ๐ป๐ฑ๐ฒ๐ฑ ๐ฐ๐ต๐ฒ๐ฐ๐ธ๐
– Ensure your public DNS zone is DNSSEC-signed.
– Confirm that any automated tooling or onboarding scripts do not assume the legacy MX hostname format.
– Use DNSSEC and mail connectivity testing tools.
โ ๏ธ ๐๐บ๐ฝ๐ผ๐ฟ๐๐ฎ๐ป๐
Existing domains are not expected to break, but environments relying on hard-coded MX validation or automation should verify compatibility.
๐๐ถ๐ต๐ฉ๐ฐ๐ณ ๐ฐ๐ง ๐ต๐ฉ๐ฆ ๐ฑ๐ฐ๐ด๐ต:
Martin Strnad
