Microsoft 365 setup check

What does each result mean?

Each line is one part of your setup, marked OK, Weak, Missing or Can't see, with what to do when something needs fixing.

Tenant

Whether Microsoft knows a tenant for your domain, with its ID and region.

Mail route

Whether mail for your domain goes straight to Microsoft 365, through a filtering service first, or somewhere else.

SPF for Microsoft 365

Whether your SPF record lets Microsoft 365 send, directly or through another include.

DKIM for Microsoft 365

Whether both signing records, selector1 and selector2, point to Microsoft. Microsoft switches between them when it rotates keys.

DMARC

What receiving servers should do with mail that fails the checks.

Autodiscover

Lets Outlook on computers and phones find the mailbox settings from the email address alone.

Device records

Needed only when Windows devices join Microsoft Entra or enrol in Intune.

Why is there a tenant when the business is not on Microsoft 365?

When someone signs up for a free Microsoft service with a work address, Microsoft can create an unmanaged tenant for the domain. It can exist without anyone using it.

If your mail is not on Microsoft 365 and the check finds a tenant, find out who controls it.

What can it not see?

Only an administrator can see whether sign-in is managed by Microsoft or federated to another system, which licences are in use, the sign-in settings and multi-factor authentication. Those matter most for security, and this check cannot reach them.

When it cannot read something, it says Can't see rather than guess. It is a first look, not an admin review.

Is the domain sent to you?

No. The check runs in your browser and reads public DNS through Cloudflare's public resolver, and your domain's public sign-in configuration from Microsoft. It stores nothing and sends nothing to us. The page shows no ads.

If you want help, Send us this report puts the domain and the findings into our contact form. Nothing reaches us until you send that form.