Check for How to enable MTA-STS in Office 365 | Cybersecurity World first as DANE can break this
Check DNS Sec first on Domain
DNSSEC Debugger ( Make sure all Green )
365
Outbound
Connect-ExchangeOnline
Enable-DnssecForVerifiedDomain -DomainName "domain.com"
Output give you MX records
Put this as Lower Priority
Move Old Record to Lower then the new Record to 0
DNSSEC and DANE Validation Test
Inbound
Enable-SmtpDaneInbound -DomainName "domain.com"