# How do you add email DNS records in Azure DNS?

URL: https://iblockspam.com/blog/add-email-dns-records-azure-dns
Last updated: 2026-10-22
Published: 2026-10-22
Topic: Setup guides
Author: iBlockSpam Team

> How to add MX, SPF, DKIM and DMARC records in Azure DNS with the portal, Azure CLI or PowerShell: record sets, @ for the apex and 255-character TXT strings.

## Short answer

In the Azure portal, open your DNS zone, select Record sets, then + Add. Enter the Name (@ for the apex, or a prefix such as _dmarc), choose MX, TXT or CNAME, set the TTL and value, and select Add. All TXT values at one name, SPF included, live in one record set, so edit the existing set rather than creating another.

Azure DNS is a good home for a domain's records if the rest of your infrastructure lives in Azure, but it thinks in **record sets**, not single records. Every TXT value at the root, including SPF and verification tokens, belongs to one TXT record set named `@`. Knowing that, and how Azure handles long TXT values, avoids most email setup problems.

This guide covers MX, SPF, DKIM and DMARC in Azure DNS through the Azure portal, the Azure CLI and Azure PowerShell, using Microsoft Learn for every step. For background on the records, read [SPF vs DKIM vs DMARC](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc).

## Is your domain actually delegated to Azure DNS?

Azure DNS hosts zones; it doesn't make them live. Records you add in an Azure **public DNS zone** only answer on the internet once your registrar points the domain at Azure's name servers. A **Private DNS zone** only answers inside your virtual networks, so email records there are invisible to senders.

Microsoft's [delegation tutorial](https://learn.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns) says: "Azure DNS assigns name servers from a pool each time a zone is created," and "Use all four name servers, regardless of the name of your domain." Its example uses names such as `ns1-37.azure-dns.com`.

1. In the Azure portal, open the DNS zone and note the four name servers on its **Overview** page.
2. At your registrar, confirm the domain's NS records list exactly those four.
3. Check from outside with our [MX Lookup](https://iblockspam.com/tools/mx-lookup) or `nslookup -type=SOA example.com`.

If the domain still uses another DNS host, add your records there instead. Our guides for [Route 53](https://iblockspam.com/blog/add-email-dns-records-route-53) and [Cloudflare](https://iblockspam.com/blog/add-dmarc-spf-dkim-records-cloudflare) cover two common alternatives.

## How do record sets work in Azure DNS?

A record set is every record with the same **name** and **type**. Microsoft Learn's [zones and records overview](https://learn.microsoft.com/en-us/azure/dns/dns-zones-records) sets out the rules that matter for email:

| Rule | What it means for email |
|---|---|
| The apex uses the relative name `@` | Root MX and SPF records go in record sets named `@` |
| Names are relative to the zone | Enter `_dmarc`, not `_dmarc.example.com` |
| TTL is set per record set, 1 to 2,147,483,647 seconds | All TXT values at `@` share one TTL |
| SPF must use the TXT type | "The obsolete SPF record type isn't supported" |
| No CNAME at the apex | The apex already holds NS and SOA record sets |
| A CNAME record set holds one record | Each DKIM selector is its own CNAME set |
| Up to 4,096 characters per TXT record set | Shared across every TXT value at that name |

At the time of writing (October 2026), Azure DNS supports A, AAAA, CAA, CNAME, MX, NS, PTR, SOA, SRV and TXT records, plus DS and TLSA when the zone is signed with DNSSEC.

## Where do you add DNS records in the Azure portal?

From Microsoft's [portal quickstart](https://learn.microsoft.com/en-us/azure/dns/dns-getstarted-portal) and [record set guide](https://learn.microsoft.com/en-us/azure/dns/dns-operations-recordsets-portal):

1. In the Azure portal, open your DNS zone.
2. Select **Record sets**, then **+ Add**. The **Add a record set** pane opens.
3. Enter the **Name** (`@` for the apex, or a prefix), choose the **Type**, leave **Alias record set** at **No**, and set **TTL** and **TTL unit**. The quickstart uses 1 hour.
4. Enter the value fields for the type.
5. Select **Add**.

To add a value to a record set that already exists, such as a second TXT value at `@`, don't create a new set. On the **Record sets** page, select the edit icon next to the set, add the value and select **Apply**. To remove one value, clear its field and select **Apply**; Microsoft notes that removing the last record doesn't delete the set itself.

## How do you add or edit an SPF record in Azure DNS?

SPF is a TXT value in the `@` TXT record set. Your domain may publish only one SPF record: [RFC 7208, section 3.2](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.2) says it "MUST NOT have multiple records" that an SPF check selects. Other TXT values, such as `MS=ms12345678` or `google-site-verification=...`, sit next to it in the same set without causing a problem.

**Portal:**

1. On **Record sets**, look for a TXT set named `@`.
2. If it exists, select its edit icon. If one value starts `v=spf1`, edit that value; otherwise add a new value with your SPF record. Select **Apply**.
3. If no `@` TXT set exists, select **+ Add**, enter `@`, choose **TXT**, paste the SPF record and select **Add**.

**Azure CLI** (from Microsoft's [CLI guide](https://learn.microsoft.com/en-us/azure/dns/dns-operations-recordsets-cli)):

```
az network dns record-set txt add-record --resource-group myresourcegroup --zone-name example.com --record-set-name "@" --value "v=spf1 include:spf.protection.outlook.com -all"
```

`add-record` creates the set if it doesn't exist, with a default TTL of 3600 seconds. The CLI guide says that to modify a TXT or MX record "you should first add a new record and then delete the existing record," using `remove-record` for the old value.

**Azure PowerShell** (from Microsoft's [PowerShell guide](https://learn.microsoft.com/en-us/azure/dns/dns-operations-recordsets)) adds a value to an existing set with `Get-AzDnsRecordSet`, `Add-AzDnsRecordConfig` and `Set-AzDnsRecordSet`:

```
Get-AzDnsRecordSet -Name "@" -ZoneName "example.com" -ResourceGroupName "MyResourceGroup" -RecordType TXT | Add-AzDnsRecordConfig -Value "v=spf1 include:spf.protection.outlook.com -all" | Set-AzDnsRecordSet
```

Our [SPF provider pages](https://iblockspam.com/spf) list each service's include, and the [SPF Record Generator](https://iblockspam.com/tools/spf-generator) merges several senders into one record.

## How do you add a DKIM record in Azure DNS?

### DKIM as CNAME records (Microsoft 365 and many senders)

Each selector is its own CNAME record set.

1. Select **+ Add**, enter `selector1._domainkey` as the **Name** and choose **CNAME**.
2. Paste the provider's target into the alias field, for example `selector1-example-com._domainkey.example.n-v1.dkim.mail.microsoft`, copied from the Defender portal.
3. Select **Add**, then repeat for `selector2._domainkey`.

The CLI equivalent is `az network dns record-set cname set-record --resource-group myresourcegroup --zone-name example.com --record-set-name selector1._domainkey --cname <target>`.

### DKIM as a TXT record (Google Workspace and others)

1. Select **+ Add**, enter the selector host, for example `google._domainkey`, and choose **TXT**.
2. Paste the whole key, starting `v=DKIM1;`, as one value.
3. Select **Add**.

### How does Azure DNS handle long DKIM keys?

You don't split them yourself in the portal, CLI or PowerShell. Microsoft Learn says: "When you use the Azure portal, PowerShell, or CLI interfaces, you should specify a single string per record. This string is automatically divided into 255-character segments if necessary." Only the REST API needs each string supplied separately.

That segmenting is standard: receivers join the strings back together, as [RFC 7208, section 3.3](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.3) and [RFC 6376, section 3.6.2.2](https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.2.2) both require. The limit to watch is the 4,096-character total per TXT record set. A 2048-bit key fits easily. If your provider shows the key split into quoted chunks, join it into one continuous string first, since Microsoft asks for a single string per record, then check the published value. Our guide to [DKIM keys too long for a TXT record](https://iblockspam.com/blog/dkim-2048-bit-key-txt-record-too-long) covers the general case.

Then turn signing on in your provider's console: see [DKIM setup for Microsoft 365 and Google Workspace](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace) and [DKIM records by provider](https://iblockspam.com/dkim).

## How do you add a DMARC record in Azure DNS?

DMARC is a TXT record set named `_dmarc`.

1. Select **+ Add**, enter `_dmarc` as the **Name** and choose **TXT**.
2. Enter your policy, for example `v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com`.
3. Select **Add**.

CLI: `az network dns record-set txt add-record --resource-group myresourcegroup --zone-name example.com --record-set-name _dmarc --value "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"`.

Keep one DMARC value in the `_dmarc` set. The [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator) builds the record, and our [none-to-reject guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) covers tightening the policy.

## How do you add or change MX records in Azure DNS?

All root MX records are one record set named `@`, each with a preference (priority) and an exchange (mail server).

**Portal:** open or create the `@` MX record set, enter each mail server with its preference number, and select **Add** (new set) or **Apply** (existing set).

**Azure CLI:**

```
az network dns record-set mx add-record --resource-group myresourcegroup --zone-name example.com --record-set-name "@" --exchange example-com.mail.protection.outlook.com --preference 0
```

**Azure PowerShell** (new set):

```
New-AzDnsRecordSet -Name "@" -RecordType MX -ZoneName "example.com" -ResourceGroupName "MyResourceGroup" -Ttl 3600 -DnsRecords (New-AzDnsRecordConfig -Exchange "example-com.mail.protection.outlook.com" -Preference 0)
```

When switching providers, add the new exchange first, then remove the old one with `az network dns record-set mx remove-record` or `Remove-AzDnsRecordConfig`. Our guide to [changing MX records without losing email](https://iblockspam.com/blog/change-mx-records-without-losing-email) covers the timing, and [TTL and propagation](https://iblockspam.com/blog/dns-ttl-mx-change-propagation) explains why to lower the TTL beforehand.

## What does a complete Azure DNS email setup look like?

An example zone for `example.com` on Microsoft 365. Your values will differ.

| Record set name | Type | Value | TTL |
|---|---|---|---|
| `@` | MX | `0 example-com.mail.protection.outlook.com` | 3600 |
| `@` | TXT | `v=spf1 include:spf.protection.outlook.com -all` and `MS=ms12345678` (two values, one set) | 3600 |
| `selector1._domainkey` | CNAME | target from the Defender portal | 3600 |
| `selector2._domainkey` | CNAME | target from the Defender portal | 3600 |
| `_dmarc` | TXT | `v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com` | 3600 |

## How do you protect email records in Azure DNS?

Email records are easy to break with an unrelated infrastructure change. Microsoft's [zone protection guide](https://learn.microsoft.com/en-us/azure/dns/dns-protect-zones-recordsets) offers two controls:

1. **Role-based access.** Grant the built-in **DNS Zone Contributor** role only to people who manage DNS, scoped to the zone's resource group.
2. **Resource locks.** Locks come in two types, **CanNotDelete** and **ReadOnly**, and apply to a public zone or an individual record set. To protect the `@` MX set, use a ReadOnly lock: Microsoft notes that a CanNotDelete lock on a record set still lets someone remove every record from it. Record-set locks can currently only be set with Azure PowerShell. A ReadOnly lock on the zone stops new record sets being created and existing ones being changed.

## How do you check the records after saving?

1. **MX**: our [MX Lookup](https://iblockspam.com/tools/mx-lookup) shows only your intended servers.
2. **SPF**: the [SPF Checker](https://iblockspam.com/tools/spf-checker) finds exactly one `v=spf1` value.
3. **DKIM**: the [DKIM Checker](https://iblockspam.com/tools/dkim-checker) returns a full key for each selector.
4. **DMARC**: the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) parses your policy.
5. **Headers**: a test message to an outside mailbox shows `spf=pass`, `dkim=pass` and `dmarc=pass`; see [how to read email headers](https://iblockspam.com/blog/how-to-read-email-headers).

## Next steps

1. Run the [Email Health Check](https://iblockspam.com/tools/email-health-check) after any change to the zone.
2. Lock the `@` MX and TXT record sets so an infrastructure deployment can't remove them.
3. Moving mail between providers? Follow the [change email hosting provider checklist](https://iblockspam.com/blog/change-email-hosting-provider-checklist).
4. The free [Domain Watch](https://iblockspam.com/free-monitoring) checks your public MX, SPF and DMARC weekly and emails you when they change.

If you route mail through a filtering service such as iBlockSpam, the `@` MX record set holds its servers instead. More walk-throughs are in [setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### How do I add a second TXT record at the root in Azure DNS?

Add it to the existing TXT record set named @ instead of creating a new one. Azure DNS groups every record with the same name and type into one record set. In the portal, open Record sets, select the @ TXT set and add the value. With the Azure CLI, az network dns record-set txt add-record appends to the set.

### Do I need to split a 2048-bit DKIM key in Azure DNS?

Not in the portal, Azure CLI or PowerShell. Microsoft Learn says to specify a single string there, and Azure DNS divides it into 255-character segments automatically. Only the REST API needs each string supplied separately. Azure DNS allows up to 4,096 characters per TXT record set in total, across all its records.

### Can I put a CNAME record at the apex of an Azure DNS zone?

No. Microsoft Learn says you can't create a CNAME record set at the zone apex, because the apex already holds the NS and SOA record sets. That follows the DNS standards rather than an Azure limit. Email records at the apex are MX and TXT, so this only matters for DKIM if a provider wrongly asks for an apex CNAME.

### Why don't my Azure DNS email records show up on the internet?

Usually the domain isn't delegated to Azure DNS. Records in an Azure public DNS zone only answer once your registrar lists all four Azure name servers assigned to the zone. Check the NS records at your registrar against the zone's Overview page, and confirm you edited a public DNS zone, not a Private DNS zone.

### How do I stop someone deleting the MX record set in Azure DNS?

Use Azure role-based access control and resource locks. Microsoft Learn describes the built-in DNS Zone Contributor role for people who manage records, and recommends a ReadOnly lock on an individual record set, such as the @ MX set. A CanNotDelete lock isn't enough there, because records can still be removed from the set.

## Sources

- [Microsoft Learn: Overview of DNS zones and records (Azure DNS)](https://learn.microsoft.com/en-us/azure/dns/dns-zones-records)
- [Microsoft Learn: Quickstart: Create an Azure DNS zone and record using the Azure portal](https://learn.microsoft.com/en-us/azure/dns/dns-getstarted-portal)
- [Microsoft Learn: Manage DNS records and record sets by using the Azure portal](https://learn.microsoft.com/en-us/azure/dns/dns-operations-recordsets-portal)
- [Microsoft Learn: Manage DNS records and record sets in Azure DNS using the Azure CLI](https://learn.microsoft.com/en-us/azure/dns/dns-operations-recordsets-cli)
- [Microsoft Learn: Manage DNS records and record sets in Azure DNS using Azure PowerShell](https://learn.microsoft.com/en-us/azure/dns/dns-operations-recordsets)
- [Microsoft Learn: Tutorial: Host your domain in Azure DNS](https://learn.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns)
- [Microsoft Learn: How to protect DNS zones and records](https://learn.microsoft.com/en-us/azure/dns/dns-protect-zones-recordsets)
- [RFC 7208: Sender Policy Framework (SPF), sections 3.2 and 3.3](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.2)

## Free tools for this guide

- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/add-email-dns-records-azure-dns (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt