Moving LokesTech Email from Hostinger to Microsoft 365

Goal

The original plan was to consider migrating old email from Hostinger into Microsoft 365. After reviewing the situation, I realized there was no mail that needed to be migrated. The real goal was simpler:

Final goal: route all valid @lokestech.com mail to Microsoft 365 and stop using Hostinger as the active mail provider.

Hostinger remains the DNS host for the domain, but Microsoft 365 becomes the mail provider.

Starting State

Item	Starting value
Domain	`lokestech.com`
DNS provider	Hostinger
Old mail provider	Hostinger Email
New mail provider	Microsoft 365 / Exchange Online
Main user mailbox	`jason.loewecke@lokestech.com`
Admin role mailbox	`admin@lokestech.com`

Important decision: no IMAP migration was needed because the required Hostinger mail had already been saved locally.

DNS Cutover

Microsoft 365 provided the required DNS records for Exchange Online mail flow and authentication. These were added in Hostinger under the domain DNS / nameserver settings.

MX Record

The MX record is the actual mail-routing switch. Hostinger MX records were removed and Microsoft 365 was added.

Type: MX
Host: @
Mail Server: lokestech-com.mail.protection.outlook.com
Priority: 0
TTL: 3600

Autodiscover CNAME

The old Hostinger autodiscover/autoconfig values were removed. Microsoft 365 autodiscover was added.

Type: CNAME
Host: autodiscover
Points to: autodiscover.outlook.com
TTL: 3600

SPF TXT Record

The existing SPF record was edited so that Microsoft 365 is the allowed sender for the domain.

Type: TXT
Host: @
Value: v=spf1 include:spf.protection.outlook.com -all
TTL: 3600

Note: only one SPF record should exist for a domain. Multiple SPF TXT records are mail-authentication cursed soup.

DKIM CNAME Records

Microsoft 365 provided two DKIM selector records. These were added as CNAME records in Hostinger.

Type: CNAME
Host: selector1._domainkey
Points to: selector1-lokestech-com._domainkey.lokestechlab.d-v1.dkim.mail.microsoft
TTL: 3600

Type: CNAME
Host: selector2._domainkey
Points to: selector2-lokestech-com._domainkey.lokestechlab.d-v1.dkim.mail.microsoft
TTL: 3600

Old Hostinger Mail DNS Cleanup

After the Microsoft records were added, old Hostinger mail-related DNS records were removed.

Removed old Hostinger MX records.
Removed old Hostinger DKIM records such as hostingermail-a._domainkey, plus B and C records.
Removed old Hostinger autoconfig CNAME record pointing to autoconfig.mail.hostinger.com.

Shared Mailbox Setup

The admin@lokestech.com address was set up as a shared mailbox instead of a normal licensed user mailbox. This keeps it as a role mailbox without wasting a Microsoft 365 license.

Mailbox	Configuration
`admin@lokestech.com`	Shared mailbox
Primary address	`admin@lokestech.com`
Member	Jason Loewecke
Permissions	Read and Manage, Send As
Removed permission	Send on Behalf Of

Reasoning: Send As is cleaner than Send on Behalf. It sends directly from admin@lokestech.com instead of showing “Jason on behalf of Admin.”

Related Defender for Business Setup

During the same session, Microsoft Defender for Business started walking through its setup wizard. The choices were kept conservative.

Security admin: Jason Admin
Email notifications: admin@lokestech.com
Device onboarding method: Local Script
Onboarding package: downloaded, but not run
Security settings: left for Intune / later management

Decision: the MSI laptop was not intentionally onboarded or enrolled yet. Device management should be planned, not accepted accidentally from a popup.

Validation

Inbound Test

A test email was sent from Gmail to admin@lokestech.com. It successfully arrived in the Microsoft 365 shared mailbox.

Outbound Test

A test email was sent from Outlook Online as admin@lokestech.com to Gmail. Gmail received it successfully.

DNS Lookup Tests

DKIM CNAME records were checked with nslookup. Public DNS resolved correctly first, then local DNS was checked after Pi-hole was brought back online.

nslookup -type=cname selector1._domainkey.lokestech.com
nslookup -type=cname selector2._domainkey.lokestech.com

Final Authentication Result

Gmail's message details showed:

SPF: PASS
DKIM: PASS
DMARC: PASS

Final result: mail flow works both directions, and Gmail accepts the domain authentication as valid.

Outlook Client Plan

The old standalone admin@lokestech.com account should be removed from the Outlook client. The better long-term setup is:

Account	Purpose
`jason.loewecke@lokestech.com`	Main Microsoft 365 / professional mailbox
`admin@lokestech.com`	Shared mailbox accessed by Jason
`jloewecke@gmail.com`	Personal account / recovery / legacy use

Important: when Outlook asks whether to “sign into all apps on this device,” choose app-only unless intentionally registering/enrolling the device.

Lessons Learned

Mail migration is not always required. Sometimes the right move is just a clean mail-flow cutover.
MX is the big switch. Once Hostinger MX records were removed, new mail routed to Microsoft 365.
Shared mailboxes are the right choice for role addresses like admin@.
Send As is cleaner than Send on Behalf for a role mailbox.
Old provider DNS records should be cleaned up after the cutover.
SPF, DKIM, and DMARC should be validated with an external recipient like Gmail.
Local DNS failures can make cloud DNS troubleshooting look broken. In this case, Pi-hole was down.
Microsoft portals sometimes throw diagnostic popups that are more useful to Microsoft support than to the admin doing the work.

Next Steps

Finish cleaning up Outlook desktop profile/account order.
Keep jason.loewecke@lokestech.com as the primary professional Outlook account.
Use admin@lokestech.com as a shared mailbox only.
Plan MSI laptop Entra registration / Intune enrollment intentionally.
Document the Defender for Business setup separately.