How to Set Up DKIM for Microsoft 365

Enable DKIM signing in Microsoft 365 Defender and publish CNAME records to allow Microsoft to sign outgoing email with your domain.

Quick Answer — The Record You Need

Record Type

CNAME

Host / Name

selector1._domainkey

Value

selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

You need two CNAME records: selector1._domainkey and selector2._domainkey. Replace yourdomain-com and yourtenant with your actual values.

Step-by-Step Setup

Open Microsoft 365 Defender

Go to security.microsoft.com and sign in with your admin account. Navigate to Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM.

Select your domain

Click on your custom domain in the DKIM page. Microsoft will display the two CNAME records you need to publish.

Add the CNAME records to your DNS

Create two CNAME records in your DNS provider with the host names and values shown by Microsoft.

selector1._domainkey  CNAME  selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com
selector2._domainkey  CNAME  selector2-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

Enable DKIM signing

Return to the Microsoft 365 Defender DKIM page and toggle the "Sign messages for this domain with DKIM signatures" switch to Enabled.

Verify DKIM is working

Send a test email and check the headers. Look for DKIM-Signature with d=yourdomain.com and a pass result in Authentication-Results.

Common Gotchas

Microsoft 365 DKIM uses CNAME records, not TXT records. The CNAMEs point to Microsoft-hosted keys that Microsoft rotates automatically.
The CNAME host names include your domain with dots replaced by dashes. For example, example.com becomes example-com in the CNAME value.
You cannot enable DKIM signing in the portal until the CNAME records have propagated. If the toggle fails, wait for DNS propagation and try again.

Verify Your Setup

After adding your DNS records, use our free DKIM checker to verify everything is configured correctly. DNS changes typically propagate within minutes, but can take up to 48 hours.

Frequently Asked Questions

What DKIM selectors does Microsoft 365 use?

Microsoft 365 uses selector1 and selector2 as DKIM selectors. Both are published as CNAME records pointing to Microsoft-managed keys under your tenant's onmicrosoft.com domain.

Does Microsoft 365 rotate DKIM keys automatically?

Yes. Because the DKIM records are CNAMEs pointing to Microsoft-managed DNS, Microsoft can rotate the underlying keys without requiring you to update your DNS records.

Why does Microsoft 365 use CNAME records for DKIM instead of TXT?

CNAME records allow Microsoft to manage and rotate the DKIM keys on their side without requiring customers to update DNS records each time a key rotation occurs.