Exchange Autodiscover Issues When a Domain Website Is Hosted on cPanel
Overview
When a customer’s website is hosted on a cPanel server but their email is hosted on a separate Microsoft Exchange server, Outlook Autodiscover may fail or behave incorrectly.
This can happen because Outlook may attempt to retrieve Autodiscover information from the customer’s primary website before checking the dedicated Exchange Autodiscover hostname or DNS SRV record.
For example:
https://example.com/autodiscover/autodiscover.xmlIf the cPanel website responds to this request instead of returning a proper HTTP error, Outlook may incorrectly interpret the response and fail to continue to the correct Exchange Autodiscover service.
Symptoms
Users may experience one or more of the following:
- Outlook repeatedly prompts for credentials.
- Outlook fails to automatically configure an Exchange mailbox.
- Outlook connects to the wrong Autodiscover location.
- Outlook reports that the mailbox or Exchange server cannot be found.
- Autodiscover works for some users but fails when the customer’s primary website is hosted on cPanel.
- Outlook attempts to access:
https://customer-domain.com/autodiscover/autodiscover.xmlinstead of the configured Exchange Autodiscover server.
Cause
Microsoft Outlook uses several methods to locate the Exchange Autodiscover service.
One of the locations Outlook may attempt is:
https://domain.com/autodiscover/autodiscover.xmlIf the customer’s website is hosted on cPanel, the web server or CMS may respond to this request.
For example, WordPress may process the request through its rewrite rules and return a WordPress-generated page or 404 response instead of allowing Apache to immediately reject the Autodiscover request.
The preferred behavior is for the website to immediately return an HTTP 404 Not Found response for:
/autodiscover/autodiscover.xmlThis allows Outlook to continue with the remaining Autodiscover discovery methods and locate the actual Exchange server.
Resolution
Add the following rules to the top of the website’s .htaccess file.
The Autodiscover block must appear before WordPress, Joomla, Drupal, or other application rewrite rules.
# =========================================================
# EXCHANGE AUTODISCOVER FIX
# =========================================================
# Prevent Outlook from attempting to use the website
# as an Exchange Autodiscover endpoint.
#
# This must appear BEFORE WordPress or other rewrite rules.
# =========================================================
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/autodiscover/autodiscover\.xml$ [NC]
RewriteRule ^ - [R=404,L]WordPress Example
For a WordPress website, the .htaccess file should look similar to the following:
# =========================================================
# EXCHANGE AUTODISCOVER FIX
# =========================================================
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/autodiscover/autodiscover\.xml$ [NC]
RewriteRule ^ - [R=404,L]
# =========================================================
# WORDPRESS
# =========================================================
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPressThe important point is that the Exchange Autodiscover block must be above the WordPress rules.
Verification
After applying the change, test the customer’s primary domain.
Open:
https://customer-domain.com/autodiscover/autodiscover.xmlThe server should return:
HTTP 404 Not FoundIt should not:
- Redirect to another page.
- Display the website homepage.
- Display a WordPress page.
- Return XML configuration information.
- Redirect to cPanel Webmail.
- Return an HTTP 200 response.
Exchange Autodiscover DNS
Blocking the website URL does not replace the customer’s Exchange Autodiscover DNS configuration.
The customer’s DNS must still contain the appropriate Autodiscover configuration for their Exchange environment.
Depending on the environment, this may be an Autodiscover hostname such as:
autodiscover.customer-domain.comor an SRV record such as:
_autodiscover._tcp.customer-domain.compointing Outlook toward the appropriate Exchange Autodiscover service.
Important Notes
Do not create an Autodiscover folder on the website
Do not create:
/public_html/autodiscover/and do not upload an autodiscover.xml file to the website.
The website is not the Exchange Autodiscover server.
The 404 response is intentional
Receiving a 404 response from:
https://customer-domain.com/autodiscover/autodiscover.xmlis expected and is the desired behavior.
It tells Outlook that the primary website does not provide Exchange Autodiscover services so Outlook can continue searching for the correct Exchange endpoint.
Place the rule before application rewrites
The Autodiscover block should always be placed before:
- WordPress rewrite rules
- Joomla rewrite rules
- Drupal rewrite rules
- Laravel/application rewrites
- Redirect plugins
- Generic catch-all rewrite rules
Otherwise, the application may intercept the Autodiscover request before Apache returns the required 404 response.
Support Checklist
When troubleshooting Outlook Autodiscover for a customer whose website is hosted on cPanel:
- Confirm where the customer’s email is hosted.
- Confirm their Exchange Autodiscover DNS records.
- Test:
https://customer-domain.com/autodiscover/autodiscover.xml- If the website processes or redirects the request, add the Autodiscover block to the top of
.htaccess. - Confirm the URL now returns HTTP 404.
- Retest Outlook Autodiscover.
- If the issue continues, investigate DNS, Exchange virtual directory configuration, SSL certificates, and Outlook’s Autodiscover cache.
Recommended .htaccess Rule
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/autodiscover/autodiscover\.xml$ [NC]
RewriteRule ^ - [R=404,L]Placement: At the very top of .htaccess, before all CMS and application rewrite rules.