How to set up DKIM for Microsoft 365

DKIM puts a digital signature on the email your business sends, so the receiving server can check that a message came from your domain and wasn't changed on the way. Microsoft 365 signs mail from your onmicrosoft.com address on its own. For a custom domain like yourbusiness.com, Microsoft says no DKIM signing happens until you set it up. (What is DKIM?)

The hands-on part is short. Most of the time goes to waiting for DNS changes to show up. You'll need a Microsoft 365 admin account and the login for your DNS host, which is often the company you bought the domain from.

Here are the steps at a glance:

1. Open the DKIM tab in the Microsoft Defender portal and select your domain.
2. Copy the two CNAME values Microsoft generates for you.
3. Add both CNAME records at your DNS host.
4. Turn on DKIM signing once Microsoft detects the records.
5. Send a test email and check its headers for dkim=pass.

Why do I need to set up DKIM in Microsoft 365?

RFC 6376, the DKIM standard, describes it as a way for the organization that owns a domain to claim some responsibility for a message. For your business, that domain should be yourbusiness.com, the one your customers see.

DKIM matters most because of DMARC, the record that tells other providers what to do with fake mail from your domain. Microsoft explains that a DKIM signature only counts toward DMARC when the signing domain matches the domain in your From address. Until you set up DKIM for yourbusiness.com, your mail has no signature that matches.

DKIM also survives situations that break SPF. When a mailing list or another server relays your message, SPF often fails, while the current DMARC standard, RFC 9989, notes that DKIM signatures generally stay valid. The same standard says a domain that publishes p=reject must not rely on SPF alone to pass DMARC, which in practice means signing its mail with DKIM.

If you plan to move DMARC past monitoring mode, do this step first.

What DNS records does Microsoft 365 DKIM use?

Microsoft 365 uses two CNAME records rather than the TXT record some other providers use. Each one points to a public key that Microsoft hosts, which lets Microsoft rotate your keys without you touching DNS again. Only one of the two (called selectors) signs mail at a time. The other is used after the next key rotation.

The record names are the same for everyone. The values are unique to your account, so the table below shows a placeholder pattern only. Don't type these in; copy your real values from the Defender portal in the next step.

The placeholder follows Microsoft's published pattern:

• yourbusiness-com is your domain with each dot changed to a dash.
• TENANT is the first part of your onmicrosoft.com address. For yourbusiness.onmicrosoft.com, it would be yourbusiness.
• X is a single letter, such as r or n, that Microsoft assigns. You can't choose it or work it out yourself, which is why copying beats typing.

Microsoft introduced this format for new custom domains in May 2025. Domains set up before then keep the older format, which ends in your onmicrosoft.com address instead, such as selector1-yourbusiness-com._domainkey.yourbusiness.onmicrosoft.com. Use whichever format the portal shows you.

Where do I find my DKIM values in the Defender portal?

For a domain that has never had DKIM keys, Microsoft's process shows an error message partway through. You can safely dismiss it. The full sequence is:

1. In the Microsoft Defender portal (security.microsoft.com), go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings. You can also go straight to security.microsoft.com/authentication.
2. Select the DKIM tab and find the row for your custom domain. Its toggle should read Disabled and its status NoDKIMKeys.
3. Slide the toggle to Enabled. Microsoft can't start signing yet, so a Client error dialog opens. That's expected. It lists your CNAME values, but they're easier to copy in a moment, so select OK.
4. The status changes to CnameMissing. Click anywhere in the domain's row, except the check box or the toggle, to open its details.
5. In the Publish CNAMEs section, note both values or select Copy. Leave this panel open in its own browser tab.

If your domain isn't on the list, it hasn't been added to Microsoft 365 yet. Follow Microsoft's instructions to add the domain first, then come back to this step.

If you're comfortable with Exchange Online PowerShell, this command shows the same two values:

Get-DkimSigningConfig -Identity yourbusiness.com | Format-List Selector1CNAME,Selector2CNAME

How do I add the CNAME records at my DNS host?

In a second browser tab, sign in to your DNS host and open the DNS records for yourbusiness.com.

1. Add a new record and choose CNAME as the type.
2. For the name (some hosts call it Host), enter selector1._domainkey.
3. For the value (sometimes called Points to or Target), paste the selector1 value from Microsoft.
4. Set the TTL to 1 hour (3600 seconds) if your host lets you choose. Microsoft recommends at least that.
5. Save, then repeat with the name selector2._domainkey and the selector2 value.

Microsoft says it can take a few minutes, or longer, to detect new records.

How do I turn on DKIM signing?

Go back to the tab with the domain details panel you left open.

1. Select the Sign messages for this domain with DKIM signatures toggle.
2. A dialog says the change may take several minutes to sync. Select OK.
3. Check that the status now reads Signing DKIM signatures for this domain.

If the toggle won't stay on, Microsoft hasn't found your records yet. Check them for typos, wait an hour, and try again. If you send email from more than one domain or subdomain in Microsoft 365, each one needs its own pair of records and its own switch.

Once signing works, Microsoft recommends changing the keys from time to time, for the same reasons you'd change a password. Select Rotate DKIM keys at the bottom of the domain details panel. The new key starts signing mail after four days (96 hours), and you can't start another rotation until then. Because your CNAME records point to Microsoft, you don't need to change anything in DNS.

See which email records your domain publishes

Our free checkup looks for DKIM at common selector names, including selector1 and selector2, along with SPF, DMARC and your website basics.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How do I check DKIM is working?

Give it a few minutes after you turn signing on, then send a test message.

1. From your Microsoft 365 mailbox, email a personal address at another provider, such as Gmail or Outlook.com. Don't test with an address in your own domain: Microsoft leaves the signature off mail between addresses in the same organization. Microsoft also advises against testing with AOL.
2. Open the full message headers. In Outlook, Microsoft calls these internet message headers. Microsoft's Message Header Analyzer (mha.azurewebsites.net) can make them easier to read.
3. Find the DKIM-Signature line. It should include d=yourbusiness.com and s=selector1 or s=selector2.
4. Find the Authentication-Results line. It should include dkim=pass.

In the signature line, d= is the domain that signed the message and s= is the selector, which tells the receiver which DNS record holds the public key. If there's no DKIM-Signature line at all, or d= shows a domain other than yourbusiness.com, go back and check that the toggle is on.

You can also look up the records yourself. On a Mac, open Terminal and run dig CNAME selector1._domainkey.yourbusiness.com +short. On Windows, nslookup -type=CNAME selector1._domainkey.yourbusiness.com does the same job. Either way, the answer should match the value you copied from Microsoft.

Why isn't my DKIM working?

Most problems trace back to a short list of mistakes in Microsoft's troubleshooting guide:

• If the status stays at CnameMissing, check that the name doesn't include your domain twice and that the record is a CNAME, not a TXT record. Microsoft 365 doesn't support TXT records for DKIM.
• If signing worked but key rotation fails later, the selector2 record is probably missing.
• If receivers occasionally report dkim=temperror, raise the TTL on both records to at least 3600 seconds.
• If the value in DNS doesn't match what Microsoft expects, copy it again from the portal instead of building it by hand. Dots, dashes and the assigned letter are easy to get wrong.
• If DKIM passes but DMARC still fails, the signing domain doesn't match your From address. This often happens with a separate newsletter or billing service, which needs DKIM set up inside that service.

DNS changes can take up to 48 hours to reach everywhere. If the status is still CnameMissing after that, compare your records against the portal's values one character at a time.

What should you do next?

With DKIM signing your mail, you're ready to use DMARC properly:

1. Check your DMARC record with our free DMARC checker, and add one at p=none if it's missing.
2. Read how to read DMARC reports so you know when it's safe to tighten the policy.
3. Work through the rest of the Microsoft 365 security checklist, from MFA to forwarding rules.
4. If other services send email as your domain and your SPF record is getting long, see SPF too many DNS lookups.