Updated · Volt Ghost team
MX records for Microsoft's consumer domains
Each domain lists exactly one mail server. Checked through Cloudflare's DNS-over-HTTPS resolver on 29 October 2026:
| Domain | Priority | MX host |
|---|---|---|
outlook.com | 5 | outlook-com.olc.protection.outlook.com |
hotmail.com | 2 | hotmail-com.olc.protection.outlook.com |
live.com | 2 | live-com.olc.protection.outlook.com |
msn.com | 2 | msn-com.olc.protection.outlook.com |
When we resolved them, the outlook.com and hotmail.com hosts each returned four IPv4 addresses, so one MX name still means several machines. The naming pattern is simple: the domain with its dot turned into a hyphen, followed by .olc.protection.outlook.com. With only one record, the priority number has nothing to compete with, so the 5 on outlook.com and the 2 on the others make no practical difference. Compare this with Gmail's ladder of five servers on the Gmail MX records page.
Consumer Outlook vs Microsoft 365
If a work address is hosted on Microsoft 365, its MX usually looks different: <domain-with-hyphens>.mail.protection.outlook.com (tenants that turned on DNSSEC for inbound mail can instead get a host under mx.microsoft). Both live under protection.outlook.com, which is why a quick glance can mislead. Our email host lookup labels both as Microsoft, and the raw host name in the MX lookup tells you which kind it is: olc means a consumer domain, mail.protection means a business tenant.
SPF and DMARC
| Domain | SPF (TXT) | DMARC policy |
|---|---|---|
outlook.com | v=spf1 include:spf2.outlook.com -all | p=none; sp=quarantine; pct=100 |
hotmail.com | v=spf1 include:spf2.outlook.com -all | p=none |
live.com | includes spf-a to spf-d.hotmail.com and spf.protection.outlook.com, ending ~all | p=none; sp=quarantine; pct=100 |
msn.com | same includes as live.com plus _spf-ssg-a.microsoft.com, ending ~all | p=none; sp=quarantine; pct=100 |
outlook.com and hotmail.com end their SPF with -all (a hard fail for any server not listed), while live.com and msn.com use the softer ~all. All four publish monitor-only DMARC for the main domain. outlook.com, hotmail.com and live.com also publish an MTA-STS record (_mta-sts); msn.com did not when we checked.
When these records help
A bounce that names olc.protection.outlook.com came from Microsoft's consumer filtering, and its error code (for example a 550 5.7.x block) points at sender reputation or authentication rather than a wrong address. Paste the full headers of a delivered message into the email header analyzer to see which SPF, DKIM and DMARC results Microsoft recorded. If you are testing a sign-up flow and don't want to use a real Outlook account, a temp email for testing receives the same confirmation mail.
Questions
What is the MX record for outlook.com?
outlook.com has one MX record: outlook-com.olc.protection.outlook.com at priority 5.
What is the MX record for hotmail.com?
hotmail.com has one MX record: hotmail-com.olc.protection.outlook.com at priority 2. live.com and msn.com follow the same pattern with live-com and msn-com host names.
How is this different from a Microsoft 365 domain?
A company domain on Microsoft 365 points its MX at a name built from the domain itself, ending in .mail.protection.outlook.com (for example contoso-com.mail.protection.outlook.com). The consumer domains use the .olc.protection.outlook.com zone instead.
Why is there only one MX host?
On 29 October 2026 the outlook.com and hotmail.com hosts each returned four IPv4 addresses, so redundancy sits behind the one name rather than in a list of backup MX records.