Microsoft recently enabled the domains tab in GCC High tenants. This has brought parity to the management capabilities for domains between commercial and GCC High tenants.
It’s finally here! The domains tab in GCC High… | TIMMCMIC
Microsoft 365 GCC High Tenants and Missing Domains | TIMMCMIC
In recent weeks I have worked with several GCC High customers that have opened cases due to the DNS errors that are present in the M365 Admin centers domain tabs. The domains tab in the M365 admin center attempts to compare a tenants DNS records to those discovered in public DNS and highlight potential issues.
DNS Errors and Warnings in the Office 365 Portal | Microsoft Learn
There are several reasons that customers may have DNS errors listed in the M365 admin center. For example, if you still have an Exchange on-premises installation your autodiscover record may point to this installation – that is perfectly acceptable. The health checks contained within the M365 admin center assume a Microsoft 365 exclusive installation.
For GCC High customers the circumstances are slightly different. Prior to the implementation of the domains tab GCC High customers were advised to calculate their DNS records manually.
Enable autodiscovery of Intune enrollment server – Microsoft Intune | Microsoft Learn
If you had previously adopted GCC High and followed the published guidance above, you will automatically have DNS errors in the M365 Admin center. The new DNS records published in the M365 admin center for GCC High customers follow the same format now as the commercial records.
Here is a summary table of before and after based on the domain contoso.us
| Record Type | Record Name | Old Value | New Value |
| MX | N/A | contoso.mail.protection.office365.us | contoso-us.mail.protection.office365.us |
| TXT | N/A | v=spf1 include:spf.protection.office365.us -all | v=spf1 include:spf.protection.office365.us -all |
| CNAME | autodiscover.contoso.us | autodiscover.office365.us | autodiscover.office365.us |
| SRV | _sipfederationtls.contoso.us | sipfed.online.gov.skypeforbusiness.us | sipfed.online.lync.com |
| CNAME | enterpriseenrollment.contoso.us | enterpriseenrollment-s.manage.microsoft.us | enterpriseenrollment-s.manage.microsoft.us |
| CNAME | enterpriseregistration.contoso.us | enterpriseregistration.windows.net | enterpriseregistration.microsoftonline.us |
The entries in the table above that are bolded represent the difference between our manual calculate guidance and the DNS records that are published in the M365 admin center. You can additionally review the records provisioned for your tenant by using the Microsoft Graph command Get-MgDomainServiceConfigurationRecord. Get-MgDomainServiceConfigurationRecord (Microsoft.Graph.Identity.DirectoryManagement) | Microsoft Learn
Is it necessary to change the DNS records for tenants that are already established? No – it is not necessary to change the DNS records at this time. The DNS records calculated manually will continue to function for GCC High customers. Customers may choose to update to the new records now that they are available for conformity to what is published within their tenant. I would recommend for new domains added to GCC High tenants that the new DNS record formats be utilized. This will help prevent issues with automatic DNS checks in the M365 admin center when adding the domain.
TIMMCMIC 