How to set up DKIM for Microsoft 365

DKIM signs your outgoing mail with a key only your sender holds, and publishes the matching public key in DNS. It can't be generated by a checker — the key comes from Microsoft 365's console — so this guide walks the console flow and the record you'll publish.

What you'll publish: Two CNAME records, always named selector1._domainkey and selector2._domainkey. The targets are tenant-specific — copy them from the portal (domains added since May 2025 get a new …dkim.mail.microsoft target format; older domains keep …onmicrosoft.com — the formats can't be mixed for a selector).

Steps

1. Open the Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM tab (security.microsoft.com/authentication).
2. Select your custom domain. To get the exact CNAME targets, slide the toggle to Enabled — the "Client error" dialog that appears lists the two required CNAME values (this is the documented way to retrieve them).
3. Publish both CNAMEs at your DNS provider, wait for them to resolve, then slide the toggle to Enabled again.

Gotchas

• ⚠Custom domains get NO DKIM signing at all until you enable it — only the built-in *.onmicrosoft.com domain is auto-signed.
• ⚠Only one selector is active at a time; the other activates when Microsoft rotates keys.
• ⚠Never copy CNAME targets from articles or examples — Microsoft's own doc says its values are illustration only. Use the portal (or PowerShell: Get-DkimSigningConfig).

Steps verified against Microsoft: configure DKIM on 2026-07-17.