How to Set Up DKIM in Microsoft 365 (Step-by-Step)

DKIM for Microsoft 365 uses two CNAME records — Microsoft rotates keys between them automatically. Publish both, enable signing, verify.

Prerequisites

Microsoft 365 admin access
DNS host access

Step 1 — Get the CNAME Values

Open Microsoft 365 Defender portal → Email & Collaboration → Policies & rules → Threat policies → Email Authentication Settings → DKIM
Select your domain
Note the two CNAMEs Microsoft displays — format:

selector1._domainkey.yourdomain.com   CNAME   selector1-yourdomain-com._domainkey.tenantid.onmicrosoft.com
selector2._domainkey.yourdomain.com   CNAME   selector2-yourdomain-com._domainkey.tenantid.onmicrosoft.com

Replace yourdomain-com with your domain (hyphens replacing dots) and tenantid with your Microsoft tenant ID.

Step 2 — Publish Both CNAMEs

At your DNS host, add two CNAME records:

Record 1:

Name — selector1._domainkey
Type — CNAME
Value — selector1-yourdomain-com._domainkey.tenantid.onmicrosoft.com
TTL — Auto or 3600

Record 2:

Name — selector2._domainkey
Type — CNAME
Value — selector2-yourdomain-com._domainkey.tenantid.onmicrosoft.com
TTL — Auto or 3600

Both are required — Microsoft rotates keys between them.

Step 3 — Verify DNS Propagation

Wait 5-30 minutes. Verify with the DKIM lookup tool — check both selectors (selector1 and selector2). At least one should return a valid public key.

Step 4 — Enable DKIM Signing

Back in Defender portal → DKIM → your domain:

Toggle Sign messages for this domain with DKIM signatures to Enabled
Microsoft immediately starts signing outbound mail

Step 5 — Verify With a Test Message

Send a message from a Microsoft 365 mailbox to an external inbox (Gmail personal, Outlook.com). Inspect headers:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yourdomain.com;
    s=selector1; ...
Authentication-Results: dkim=pass header.d=yourdomain.com;

dkim=pass = signing is working. Selector should be selector1 or selector2.

Step 6 — Automatic Rotation

Microsoft rotates DKIM keys between selector1 and selector2 automatically — no manual intervention needed. When Microsoft rotates, they update the target of the CNAME internally, and your published CNAMEs continue to point to the correct backend.

Common Miss

Publishing only one CNAME (selector1) — Microsoft rotates to selector2 and mail starts failing DKIM
Wrong CNAME target format — must include your tenant ID
Not enabling the signing toggle in Defender — records exist but no signing happens
Adding TXT records instead of CNAME — Microsoft’s model uses CNAMEs pointing to Microsoft-hosted DNS

Verify with the DKIM lookup tool and confirm end-to-end with the email authentication checker.

Read what DKIM is, check the DKIM glossary entry, and see the DKIM selector entry for how rotation works.