Listing Actual vs Expected DNS Records for a Microsoft 365 Tenant with PowerShell

In this post we will be looking at how we can list actual vs expected DNS records for a Microsoft 365 tenant with PowerShell.


A Microsoft Office 365 Tenant requires certain DNS entries to be in place, for a verified domain, to ensure things like mail, collaboration and device management all work as expected. Your tenant will show you the Status of a domain that you have added to your tenant

  1. Navigate to Microsoft 365 admin center
  2. Navigate to Settings > Domains

When the page indicates Possible Service issues it means that you don’t have the DNS records configured that your tenant is expecting. Now – this may be totally by design for larger orgs who are running Hybrid Exchange, using an external mail protection service, running a Skype for Business Hybrid and a 3rd Party MDM solution. If you click on the Domain Name you will see more info

and clicking on the DNS Records tab will reveal more. An Error does not indicate the service is not working but merely that your tenant was expecting the appropriate Microsoft assigned DNS record being in place instead of your custom one.

Previously, the M365 Admin Centre would show the Actual vs Expected DNS records all on the same page. Today you have to click on each record to see what is programmed

This can become quite laborious, especially if you have lots of verified domains on your tenant that you wish to check the DNS records for.

The Script

We are using two cmdlets in the following script: –

  • Resolve-DNSName
  • Get-AzureADDomainServiceConfigurationRecord

We can use Resolve-DNSName to resolve the Actual DNS entry for a domain registered in our tenant and Get-AzureADDomainServiceConfigurationRecord to check the Expected DNS record from Microsoft

Example: –

Retrieve the Expected DNS CNAME record for from our tenant for the verified domain

Retrieve the Actual MX record for using Googles DNS Server


  1. Global Administrator for your Tenant
  2. AzureAD Module
  3. MSOnline Module
  4. Get_MSOLDomainDNS.ps1

If you don’t specify the DNSServer parameter, the default Google DNS is used ( Once you login to your tenant, the script will list all verified domains in a GridView. You can select multiple domains to check DNS entries.

You can also specify the colour of the Expected vs Actual DNS records and caught errors by modifying the following variables: –

$CustomRecordColor = “Cyan”
$MSRecordColor = “Yellow”
$ErrorColor = “Red”

M365/Get_MSOLDomainDNS.ps1 at main · byteben/M365 (

If you want to make suggestions please reach out on Twitter or Fork the script on GitHub. Thanks.

5/5 - (2 votes)

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.


This site uses Akismet to reduce spam. Learn how your comment data is processed.