DANE

Enable inbound SMTP DANE with DNSSEC in Exchange Online and switch your MX

Step-by-step: move an Exchange Online accepted domain to its DNSSEC-capable mx.microsoft MX record, then turn on inbound SMTP DANE and verify the TLSA records.