How to Set Up DKIM in Microsoft 365 (Office 365)

Microsoft 365 (formerly Office 365) supports DKIM signing out of the box, but it's not enabled by default for custom domains. This guide walks you through enabling DKIM for your Microsoft 365 email, from creating the DNS records to verifying everything works.

Before You Start

You'll need:

• Admin access to your Microsoft 365 tenant
• Access to your domain's DNS settings (GoDaddy, Cloudflare, Namecheap, etc.)
• A custom domain already added and verified in Microsoft 365

How Microsoft 365 DKIM Works

Microsoft uses two selectors for DKIM: selector1 and selector2. These point to Microsoft's servers via CNAME records, and Microsoft handles the actual public keys behind the scenes.

This approach has advantages:

• Microsoft can rotate keys automatically
• You don't need to update DNS when keys change
• Setup is simpler (just two CNAME records)

Step-by-Step Setup

Verify Your Setup

After enabling DKIM, verify it's working correctly.

Test both selectors:

• selector1._domainkey.yourdomain.com
• selector2._domainkey.yourdomain.com

You can also send a test email to an external address (like a personal Gmail) and check the email headers. Look for:

Authentication-Results: ...
  dkim=pass header.d=yourdomain.com header.s=selector1

Common Issues and Solutions

"CNAME record doesn't exist"

Cause: DNS hasn't propagated yet, or there's a typo in your DNS records.

Solution:

• Double-check the CNAME record values match exactly what Microsoft provided
• Wait longer for propagation (up to 48 hours in rare cases)
• Use a DNS checker to verify your records are visible globally

"Client Error" when enabling DKIM

Cause: Usually a DNS propagation issue or incorrect record values.

Solution:

• Verify both CNAME records exist and are correct
• Clear your browser cache and try again
• Wait 30 minutes and retry

DKIM shows enabled but emails fail verification

Cause: Emails may be going through another service (like a mailing list or security gateway) that modifies them.

Solution:

• Check if emails are being routed through third-party services
• Verify the email headers to see where the signature breaks

DKIM for Multiple Domains

If you have multiple custom domains in Microsoft 365, you need to set up DKIM for each one separately. Repeat the process for each domain:

1. Add the domain-specific CNAME records to that domain's DNS
2. Enable DKIM signing for that domain in the Defender portal

Each domain gets its own set of selector1/selector2 CNAME records pointing to domain-specific Microsoft addresses.

PowerShell Alternative

If you prefer command line or need to automate setup, you can use PowerShell:

# Connect to Exchange Online
Connect-ExchangeOnline

# View DKIM configuration
Get-DkimSigningConfig -Identity yourdomain.com

# Enable DKIM
Set-DkimSigningConfig -Identity yourdomain.com -Enabled $true

# Create new DKIM signing config (if it doesn't exist)
New-DkimSigningConfig -DomainName yourdomain.com -Enabled $true

Key Rotation

Microsoft handles DKIM key rotation automatically—that's the benefit of using CNAME records. You don't need to update your DNS when Microsoft rotates keys.

However, if you need to manually rotate keys (rare), you can use PowerShell:

Rotate-DkimSigningConfig -KeySize 2048 -Identity yourdomain.com

Complete Your Email Authentication

DKIM is one part of email authentication. For complete protection, also configure:

SPF: Verify your SPF record includes Microsoft 365's servers. Check at spfrecordcheck.com.

DMARC: Set up a DMARC policy to tell receivers what to do when authentication fails. Check at dmarcrecordchecker.com.

Microsoft 365's default SPF include is: include:spf.protection.outlook.com

Monitor Your DKIM Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.