How to Enable DKIM in Microsoft 365

Quick answer

1. Get the two CNAME values for your domain from the Defender portal (DKIM tab) or with Get-DkimSigningConfig.
2. At your DNS host, create CNAME selector1._domainkey and CNAME selector2._domainkey pointing at those exact values.
3. Turn on signing: the toggle on the DKIM tab, or Set-DkimSigningConfig -Identity contoso.com -Enabled $true.
4. Send a message to an outside mailbox and confirm dkim=pass with d=contoso.com.

Your *.onmicrosoft.com domain is already signed automatically. Custom domains are not signed with an aligned key until you do the steps below, and DMARC needs that aligned signature.

How DKIM works in Microsoft 365

Microsoft generates two key pairs per custom domain and keeps the private keys. You don't publish the public key as a TXT record yourself. Instead you publish two CNAME records that point to keys Microsoft hosts, so Microsoft can rotate keys without you editing DNS again. Only one selector signs at a time; the other is used after the next key rotation. That's why you need both CNAMEs.

Before you start

• The domain must already be added and verified in Microsoft 365. In Exchange Online PowerShell, Get-AcceptedDomain lists it.
• You need admin rights to manage email authentication settings in the Defender portal or Exchange Online PowerShell (for example the Security Administrator or Exchange Administrator role).
• You need access to the domain's DNS host.
• For PowerShell: Install-Module ExchangeOnlineManagement, then Connect-ExchangeOnline.

Step 1: Get your CNAME values

Option A: Defender portal

1. In the Microsoft Defender portal (security.microsoft.com), go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings and open the DKIM tab. The direct link is https://security.microsoft.com/authentication?viewid=DKIM.
2. Find your custom domain. If its status is NoDKIMKeys, try switching its toggle to Enabled. You'll get an error saying the CNAMEs are missing; that's expected. Select OK.
3. Open the domain (click the row, not the toggle). The details flyout lists the two values under Publish CNAMEs, with a Copy button. Leave the flyout open.

Option B: Exchange Online PowerShell

Get-DkimSigningConfig | Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME

If your domain isn't listed, create its keys first, choosing 2048-bit (Microsoft's documented default for -KeySize is 1024):

New-DkimSigningConfig -DomainName contoso.com -Enabled $false -KeySize 2048

Run Get-DkimSigningConfig again. The domain should show Enabled: False and Status: CnameMissing, plus the two SelectorNCNAME values.

Step 2: Understand the CNAME format (then copy, don't type)

Microsoft changed the target format in May 2025. Domains added since then get the new format; older custom domains keep the old one. Both are valid, but the two formats can't be mixed for the same selector.

New format (newer custom domains):

selector1._domainkey  CNAME  selector1-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft
selector2._domainkey  CNAME  selector2-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft

Old format (existing custom domains):

selector1._domainkey  CNAME  selector1-contoso-com._domainkey.contoso.onmicrosoft.com
selector2._domainkey  CNAME  selector2-contoso-com._domainkey.contoso.onmicrosoft.com

• contoso-com is your custom domain with dots replaced by dashes (marketing.contoso.com becomes marketing-contoso-com).
• contoso (after _domainkey.) is the prefix of your initial *.onmicrosoft.com domain, not your custom domain.
• In the new format, the n in n-v1 is a partition letter Microsoft assigns (for example n or r). You can't predict it. Two domains in the same tenant can get different letters.

The values above are illustrations. Always paste the exact Selector1CNAME / Selector2CNAME values from your tenant.

Step 3: Create the two CNAME records

1. Host/Name: selector1._domainkey and selector2._domainkey. Most DNS hosts add your domain automatically, so don't type selector1._domainkey.contoso.com or you'll end up with selector1._domainkey.contoso.com.contoso.com.
2. Type: CNAME, not TXT. A TXT record with a pasted public key doesn't work with Microsoft 365.
3. Value/Target: the exact selector value. Some hosts (Amazon Route 53, for example) need a trailing dot on the target; others add it for you.
4. TTL: Microsoft recommends at least 3600 seconds.
5. Cloudflare DNS: set the records to DNS only (grey cloud). Proxied records won't resolve to Microsoft's DKIM hosts.

Check that both names resolve with the DNS Lookup tool (type CNAME) and the DNS Propagation Checker. From Windows: nslookup -type=CNAME selector1._domainkey.contoso.com. To inspect the public key behind the CNAME, look up the TXT record of selector1._domainkey.contoso.com and paste it into the DKIM Record Explainer, which shows the key type and size.

Step 4: Turn on DKIM signing

Portal: after a few minutes (sometimes longer while DNS propagates), go back to the domain's flyout on the DKIM tab and turn on Sign messages for this domain with DKIM signatures. Once Microsoft sees the CNAMEs, the status changes to Signing DKIM signatures for this domain.

PowerShell:

Set-DkimSigningConfig -Identity contoso.com -Enabled $true
Get-DkimSigningConfig -Identity contoso.com | Format-List Name,Enabled,Status

You want Enabled: True and Status: Valid. If the CNAMEs aren't detected yet, the command fails and prints the values it expects. Compare them with DNS character by character (dots, dashes and underscores are easy to get wrong), wait, and try again.

Step 5: Verify signing

1. Send a message from a user in the domain to an outside mailbox (Outlook.com or Gmail, for example). Mail between users of the same organization isn't DKIM signed, so an internal test proves nothing.
2. Open the message headers and paste them into the Email Header Analyzer.
3. In DKIM-Signature, look for d=contoso.com and s=selector1 (or selector2). In Authentication-Results, look for dkim=pass with header.d=contoso.com (or header.i=@contoso.com).
4. Run the Email Deliverability Checker to see SPF, DKIM and DMARC together.

Step 6: Move to 2048-bit keys and rotate

Older Microsoft 365 domains were often set up with 1024-bit keys. To check:

Get-DkimSigningConfig -Identity contoso.com | Format-List Selector1KeySize,Selector2KeySize,KeyCreationTime,RotateOnDate,SelectorBeforeRotateOnDate,SelectorAfterRotateOnDate

Rotate to a new 2048-bit key:

Rotate-DkimSigningConfig -Identity contoso.com -KeySize 2048

• The new key starts signing after four days (96 hours), at RotateOnDate. Until then the current key keeps signing, and you can't start another rotation.
• The new key size applies to the selector that becomes active. To get both selectors to 2048 bits, rotate again after the first rotation finishes.
• No DNS change is needed because the CNAMEs point at Microsoft-hosted keys. That's also why both CNAMEs must stay in place.
• In the portal, the domain's flyout has Rotate DKIM keys, which rotates without changing the key size.
• Microsoft doesn't rotate the *.onmicrosoft.com key automatically.

Subdomains and other senders

• Every custom domain and every subdomain that sends from Microsoft 365 needs its own DKIM configuration and its own two CNAMEs.
• Third-party senders sign with their own keys under their own selector names. Publish the records they give you and make sure the signature uses d= your domain (or the subdomain you send from), or DMARC won't count it as aligned.
• Don't publish DKIM records for parked domains that never send mail.

Troubleshooting

• Status stays CnameMissing: wrong host name (domain doubled), TXT instead of CNAME, a typo in the target, records in the wrong DNS zone, or Cloudflare proxy turned on. Compare with Get-DkimSigningConfig output.
• Rotation fails: the selector2._domainkey CNAME is missing.
• dkim=pass but DMARC fails: the signing domain (d=) doesn't align with the From domain. This is typical of third-party services signing with their own domain.
• dkim=fail after forwarding or a mailing list: something changed the message after signing. Receivers can rely on ARC; in Microsoft 365 you can add intermediaries as trusted ARC sealers for inbound mail.

Next, publish a DMARC record so receivers know what to do with mail that fails both SPF and DKIM.

Related tools and guides

Inspect keys with the DKIM Record Explainer, confirm the CNAMEs with the DNS Lookup and DNS Propagation Checker, read test headers in the Email Header Analyzer, and find a domain's tenant with the M365 Tenant Lookup. Related guides: SPF for Microsoft 365 and DMARC for Microsoft 365.

FAQ

What are the DKIM CNAME records for Microsoft 365?

Two CNAMEs: selector1._domainkey and selector2._domainkey. Custom domains added since May 2025 point to targets like selector1-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft; older domains use selector1-contoso-com._domainkey.contoso.onmicrosoft.com. Copy the exact values from the Defender portal or Get-DkimSigningConfig.

Why does Microsoft 365 use CNAME records instead of a TXT record for DKIM?

Microsoft keeps the private keys and hosts the public keys. The CNAMEs point to those keys, so Microsoft can rotate them without you changing DNS. A TXT record with a pasted key is not supported for Microsoft 365 signing.

How do I enable DKIM with PowerShell?

Connect-ExchangeOnline, run Get-DkimSigningConfig to read the selector CNAME values (or New-DkimSigningConfig -DomainName contoso.com -Enabled $false -KeySize 2048 if the domain is not listed), publish both CNAMEs, then run Set-DkimSigningConfig -Identity contoso.com -Enabled $true and confirm Status is Valid.

How do I upgrade Microsoft 365 DKIM to 2048-bit keys?

Run Rotate-DkimSigningConfig -Identity contoso.com -KeySize 2048. The new key starts signing after about four days (96 hours). The size applies to the newly active selector, so rotate again after the first rotation completes to move the other selector to 2048 bits.

Why is my test message not DKIM signed?

Mail sent between users in the same organization is not DKIM signed, so test by sending to an outside mailbox. If outside mail is still unsigned, check that the domain status is Valid in Get-DkimSigningConfig and that both CNAMEs resolve publicly.

Want the full kit?

Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.