Setting up an Exchange Online environment with Strato: a complete technical guide for IT admins
A modern email environment demands reliability, security, and flawless message delivery. Exchange Online provides exactly that, but successfully setting up an Exchange Online environment requires a well‑thought‑out approach. We use Strato as the hosting and DNS provider. This guide walks you through the entire process step by step, including correctly configuring SPF, DKIM, and DMARC to achieve maximum deliverability.
This blog post describes the various steps needed to configure the Exchange Online environment. The process is demonstrated using Strato because it is the hosting provider I personally use. Similar steps are required when working with other providers.
Steps for setting up an Exchange Online environment
A solid start begins with a controlled foundation.
- Verify that your domain is active within Strato.
- Ensure you have access to the Strato DNS management panel.
- Gather the Microsoft 365 tenant details (admin account, domain status, MX records).
Important keyword: As soon as you add the domain in Microsoft 365, you must immediately perform the TXT verification. This prevents propagation delays.
Go to Settings → Domains → Add domain and enter your Strato domain. Microsoft will display a TXT record that you must add in Strato. In the Strato DNS panel:
- Open Domain Management.
- Select DNS settings.
- Add the TXT record exactly as shown by Microsoft.
Wait a few minutes and click Verify in Microsoft 365.
Tip: Strato can sometimes be strict with record validation. Pay attention to double quotes and spaces.
Once the domain is verified, Microsoft will display the required DNS records. For Strato, these must be entered manually.
Required records:
| Type | Hostname | Waarde | Doel |
|---|---|---|---|
| MX | @ | .mail.protection.outlook.com | Incoming mail |
| TXT | @ | v=spf1 include:spf.protection.outlook.com -all | SPF |
| CNAME | autodiscover | autodiscover.outlook.com | Autodiscover |
| CNAME | selector1._domainkey | selector1-.domainkey..onmicrosoft.com | DKIM |
| CNAME | selector2._domainkey | selector2-.domainkey..onmicrosoft.com | DKIM |
| SRV | _sip._tls | sipdir.online.lync.com | Teams/Skype |
| SRV | _sipfederationtls._tcp | sipfed.online.lync.com | Teams/Skype |
Note: Strato does not support wildcard records for DKIM. You must enter both selectors exactly.
SPF determines which mail servers are allowed to send mail on behalf of your domain.
For Exchange Online, the recommended value is:
v=spf1 include:spf.protection.outlook.com -allWhy is this important? Without a correct SPF record, spam filters are more likely to flag your domain as suspicious, directly affecting deliverability.
Go to Security → Threat Management → Policy → DKIM.
- Select your domain.
- Click Enable.
- Microsoft will check whether the CNAME records exist in Strato.
- After propagation (usually 5–30 minutes), DKIM becomes active.
Advantage: DKIM cryptographically signs every outgoing email, allowing recipients to verify that the message has not been tampered with.
DMARC builds on SPF and DKIM and instructs receiving mail servers how to handle failed verifications.
Start with a mild policy:
v=DMARC1; p=none; rua=mailto:dmarc@jouwdomein.nl; ruf=mailto:dmarc@jouwdomein.nl; fo=1After a few weeks, once you have analyzed the reports, you can scale up to:
p=quarantinep=reject
Why phased? You first want insight into legitimate senders who may not yet be configured correctly.
Even with correct DNS records, you still need to build domain reputation. Algorithms from Microsoft, Google, and other providers look at:
✔️ Consistent sending behavior
Avoid sudden spikes in mail volume.
✔️ Low bounce ratio
Verify that all mailboxes exist before sending bulk mail.
✔️ Authenticated Received Chain (ARC)
Exchange Online supports ARC, which helps in forwarding scenarios.
✔️ Reverse DNS (PTR)
This is automatically handled by Microsoft for outgoing mail.
✔️ Avoid spam‑like content
IT admins know this, but it remains relevant: words like free, buy now, discount can harm deliverability.
✔️ Use Microsoft 365 Defender reporting
This shows exactly how your domain is performing and where improvements are needed.
Use tools such as:
- Microsoft Remote Connectivity Analyzer
- MXToolbox (SPF, DKIM, DMARC checks)
- Google Postmaster Tools
- Microsoft 365 Message Trace
Test both incoming and outgoing mail and verify that DKIM signatures are visible in the headers.
Conclusion: setting up an Exchange Online environment
Setting up an Exchange Online environment with Strato as the hosting and DNS provider requires precise configuration, but it results in a robust, secure, and scalable email infrastructure. By correctly configuring SPF, DKIM, and DMARC and actively monitoring them, you quickly build a strong domain reputation and prevent mail from ending up in the spam folder.
Finally, you can find more information about Microsoft Exchange here. If you have any questions about this blog post, you can submit them via the contact form.
