How to enable DKIM in Microsoft 365

Why turn on DKIM

DKIM adds a digital signature to every message you send. The receiving server checks the signature against a public key in your DNS, which proves the message wasn't altered and that it was sent with your domain's authority.

Microsoft automatically signs email from your yourcompany.onmicrosoft.com domain, but email from your custom domains isn't signed with your own domain until you configure DKIM. That matters for DMARC: a signature must match the domain in the From address to count. Without DKIM, DMARC depends on SPF alone, and SPF fails whenever a message is forwarded.

Before you start

• The domain is added and verified in Microsoft 365.
• You can sign in to the Microsoft Defender portal with an admin role that manages email security policies, such as Security Administrator.
• You can create CNAME records at your DNS host.

Step 1: Open the DKIM settings

In the Microsoft Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings, then select the DKIM tab. You can also open security.microsoft.com/authentication?viewid=DKIM directly.

You'll see a row for each domain, with a Toggle and a Status. A domain that has never been set up shows the toggle as Disabled and the status as NoDKIMKeys.

Step 2: Get your CNAME records

1. In the domain's row, switch the Toggle to Enabled.
2. A Client error message appears, listing the CNAME records to publish. This is expected: Microsoft can't sign until the records exist. Select OK. The status changes to CnameMissing.
3. Select the domain's row (not the checkbox or the toggle) to open its details. Copy the two values under Publish CNAMEs.

Step 3: Publish the two CNAME records

At your DNS host, create two CNAME records. The host names are the same for every organization. The values are unique to yours, so always copy them from the portal:

• Most DNS hosts add your domain automatically, so enter only selector1._domainkey as the host name.
• If your DNS host offers a proxy option, as Cloudflare does, set these records to DNS only.
• DNS changes can take anywhere from a few minutes to several hours to be detected.

Step 4: Turn on DKIM signing

1. Go back to the DKIM tab and open the domain's details again.
2. Turn on Sign messages for this domain with DKIM signatures.
3. When the details show Signing DKIM signatures for this domain, Microsoft 365 is signing outgoing email from that domain.

If you still see an error, Microsoft hasn't detected the CNAME records yet. Wait a while and try again, or see troubleshooting.

Step 5: Check that it works

1. Send a message from a mailbox on the domain to an external address, such as a personal Gmail or Outlook.com account.
2. Open the message headers. In Gmail, use ⋮ → Show original.
3. Look for dkim=pass with header.d=yourdomain.com. If the signing domain is still onmicrosoft.com, signing isn't active yet.

Our free Email Header Analyzer reads the headers for you and shows whether DKIM passed and aligned with your From domain.

Using PowerShell instead

If you manage many domains, Exchange Online PowerShell is faster:

# See DKIM status and CNAME values for every domain
Get-DkimSigningConfig | Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME

# Create the configuration for a domain (signing off until the CNAMEs exist)
New-DkimSigningConfig -DomainName contoso.com -Enabled $false

# After publishing the CNAMEs, turn on signing
Set-DkimSigningConfig -Identity contoso.com -Enabled $true

2048-bit keys and key rotation

Microsoft creates 1024-bit keys by default. You can move to stronger 2048-bit keys by rotating:

Rotate-DkimSigningConfig -Identity contoso.com -KeySize 2048

• A rotation takes effect after about four days (96 hours). Until then, the previous key keeps signing.
• Microsoft keeps two selectors and signs with one at a time. The first rotation upgrades the next selector, so rotate a second time, after the first completes, to upgrade both.
• You can also rotate in the portal: open the domain's details and select Rotate DKIM keys.
• Your CNAME records don't change when you rotate, so there's nothing to update in DNS.

Subdomains and parked domains

• Each sending subdomain needs its own DKIM setup and its own pair of CNAME records. For example, news.contoso.com isn't covered by contoso.com.
• Microsoft recommends sending bulk or third-party email from a subdomain, so that any reputation problems don't affect your main domain.
• Don't publish DKIM records for domains that never send email. Instead, protect them with v=spf1 -all and a p=reject DMARC record. See our DMARC guide.

Troubleshooting

The status stays CnameMissing

• Check the host names. If you typed selector1._domainkey.yourdomain.com and your DNS host also added the domain, the record ends up at the wrong name.
• Check for typos in the values. Copy and paste them rather than retyping.
• Turn off proxying for the records if your DNS host offers it.
• Give it time. Some DNS hosts take several hours to publish changes.

Messages still show the onmicrosoft.com signature

Signing isn't turned on for the domain yet, or the message was sent from a different domain or subdomain. Check the domain's details in the DKIM tab, and the domain in the test message's From address.

DKIM fails after the message leaves Microsoft 365

Something changed the message after Microsoft signed it, such as an email signature service, a disclaimer, or a security gateway that edits outbound mail. Make sure those services hand mail back to Microsoft 365 before it's delivered, or that they sign it with your domain themselves.

A third-party service still fails DMARC

Microsoft 365's DKIM only covers email sent through Microsoft 365. Newsletter tools, CRMs and other services need their own DKIM setup for your domain. See why third-party email fails DMARC.