Outlook Autodiscover Failed

When adding a new email account, Outlook uses Autodiscover to automatically configure server settings. If this process fails, you may see errors like “An encrypted connection to your mail server is not available”, “Outlook cannot set up your account”, or the account setup wizard hangs indefinitely. This guide helps you diagnose and resolve Autodiscover failures.

Step 1: Understand How Autodiscover Works

Autodiscover uses a series of lookups to find your Exchange or Microsoft 365 server settings.

Outlook attempts these methods in order:

1. HTTPS root domain: https://yourdomain.com/autodiscover/autodiscover.xml
2. HTTPS autodiscover subdomain: https://autodiscover.yourdomain.com/autodiscover/autodiscover.xml
3. HTTP redirect: http://autodiscover.yourdomain.com/autodiscover/autodiscover.xml (follows redirects)
4. DNS SRV record: Looks up _autodiscover._tcp.yourdomain.com
5. Local XML file: Checks for a local Autodiscover XML configuration

If all methods fail, Outlook cannot automatically configure the account. The specific failure point determines which fix to apply.

Step 2: Test Autodiscover Connectivity

Use Outlook’s built-in Autodiscover test to identify the failure point.

1. Hold Ctrl and right-click the Outlook icon in the system tray.
2. Select Test E-mail AutoConfiguration.
3. Enter your email address and password.
4. Uncheck Use Guessmart and Secure Guessmart Authentication to isolate the Autodiscover process.
5. Check only Use AutoDiscover.
6. Click Test and review the Log tab for errors.
7. The Results tab will show the discovered server settings if successful.
8. Common errors in the log:
   • “Failed to reach the autodiscover URL” — DNS or network issue
   • “Certificate error” — SSL certificate mismatch
   • “401 Unauthorized” — Authentication failure
   • “Redirect” — Autodiscover is redirecting to an incorrect URL

Alternatively, test from the command line:

nslookup -type=SRV _autodiscover._tcp.yourdomain.com

Step 3: Fix DNS and Domain Configuration Issues

Incorrect DNS records are the most common cause of Autodiscover failures.

1. Verify the Autodiscover CNAME record exists:

nslookup autodiscover.yourdomain.com

2. For Microsoft 365, the CNAME should point to:

autodiscover.outlook.com

3. If using Exchange on-premises, ensure the Autodiscover DNS record points to your Exchange server.
4. Check the SRV record:

nslookup -type=SRV _autodiscover._tcp.yourdomain.com

5. The SRV record should resolve to your mail server on port 443.
6. If DNS records are missing, add them through your domain registrar’s DNS management panel:
   • Type: CNAME
   • Host: autodiscover
   • Value: autodiscover.outlook.com
   • TTL: 3600
7. After adding DNS records, allow up to 48 hours for propagation, though most changes take effect within 1–4 hours.
8. Flush your local DNS cache to pick up changes immediately:

ipconfig /flushdns

Step 4: Manually Configure the Account

If Autodiscover cannot be fixed immediately, manually configure the account as a workaround.

1. Open File > Add Account in Outlook.
2. Enter your email address and click Advanced options.
3. Check Let me set up my account manually.
4. Select the account type:
   • Microsoft 365 — for Office 365 / Exchange Online accounts
   • Exchange — for on-premises Exchange servers
   • IMAP — for third-party email providers
5. For Exchange Online, use these settings:
   • Server: outlook.office365.com
   • Encryption method: SSL/TLS
   • Port: 443
6. For Exchange on-premises, enter the internal or external URL of your Exchange server (e.g., mail.yourdomain.com).
7. Enter your credentials and click Connect.
8. Once the account is working, work with your IT team to fix the Autodiscover DNS records for future setups.

Step 5: Resolve Certificate and Authentication Errors

SSL certificate mismatches and authentication failures can block Autodiscover even when DNS is correct.

1. If you see a certificate warning during account setup:
   • Click View Certificate and check the Subject or Subject Alternative Name
   • Verify the certificate matches your mail server’s hostname
   • If there is a mismatch, the certificate needs to be updated on the server
2. For Modern Authentication issues with Microsoft 365:
   • Ensure Modern Authentication is enabled in your tenant:

Get-OrganizationConfig | Format-List OAuth*

• OAuth2ClientProfileEnabled should be True

3. If Outlook prompts repeatedly for credentials:
   • Clear saved credentials from Credential Manager:
     • Open Control Panel > Credential Manager > Windows Credentials
     • Remove all entries related to Outlook, Office, or your domain
   • Restart Outlook and enter your credentials again
4. On macOS, clear credentials from Keychain:

security delete-generic-password -s "Microsoft Office Identities Settings 3"

5. If your organization uses ADFS or Conditional Access policies, check with your IT administrator to ensure your device meets the access requirements.