DKIM Setup Guide for Microsoft 365 (2026)

Most Microsoft 365 accounts are set up with basic SPF configured and nothing else. That covers about one-third of the authentication picture. The remaining two-thirds -- DKIM and DMARC -- get skipped because they feel optional until something goes wrong.

DKIM is not optional in 2026. Per Google's Email Sender Guidelines, Google and Yahoo made DKIM mandatory for bulk email senders in February 2024. More practically, Outlook and Gmail spam filters treat emails without DKIM signatures with noticeably more suspicion. A Microsoft 365 account with only SPF configured is easier to spoof than one with DKIM active, because DKIM is the record that proves the email content was not modified in transit and genuinely came from your domain.

Microsoft 365 handles DKIM differently from most email providers. Instead of a TXT record with a public key you manage directly, Microsoft uses a rotating key system. You publish two CNAME records that point to Microsoft's key infrastructure. Microsoft rotates the actual keys automatically. The tradeoff is that setup requires understanding what you are creating and why, because the CNAME records can be confusing the first time you see them.

This guide goes through the whole process in order.

What is DKIM?

DKIM (DomainKeys Identified Mail), defined in RFC 6376, is a cryptographic signature applied to every email you send. The signature proves two things: the email genuinely originated from a server authorized by your domain, and the email content was not altered after it was signed.

It is different from SPF, which only verifies that the sending IP address is on your authorized list. SPF says nothing about what happened to the email after it left your server. DKIM proves the email arrived intact.

A simple way to think about the three authentication records:

If someone intercepts your email and modifies a link in the body, DKIM catches it. The signature covers the email headers and body. Change one character and the signature no longer matches the public key in DNS. The receiving server knows something is wrong.

DKIM also has a property SPF does not: it survives email forwarding. When an email is forwarded, the sending IP changes, which breaks SPF. But the DKIM signature is attached to the message itself, not the IP. As long as the content is not modified during forwarding, DKIM remains valid. This is one reason DKIM matters independently of SPF.

Why Microsoft 365 needs DKIM

Without DKIM, Microsoft 365 emails have no cryptographic proof of origin. Receiving servers at Gmail, Yahoo, and other providers cannot verify the email was not modified in transit or that it genuinely came from your domain's authorized infrastructure.

For cold email senders and marketers using Microsoft 365, missing DKIM is a measurable deliverability problem. Adding DKIM to a properly configured SPF domain consistently moves inbox placement at Gmail into the 90%+ range. The difference between a domain with SPF only and a domain with SPF plus DKIM is visible in Google Postmaster Tools reputation scores.

How DKIM works

The four-step process:

How Microsoft 365 DKIM is different

Most email providers give you a single DKIM TXT record containing a public key that you publish in DNS yourself. Microsoft 365 works differently.

This has two practical implications:

First, the DNS records you create are CNAME records, not TXT records. This confuses people who have set up DKIM on other platforms and expect a TXT record with a key value in it.

Second, you cannot see or manage the actual cryptographic keys. Microsoft manages them. This is generally fine for most organizations, but worth understanding so you do not go looking for a key value to put in your DNS.

The two CNAME records Microsoft requires:

selector1._domainkey.yourdomain.com
CNAME -> selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

selector2._domainkey.yourdomain.com
CNAME -> selector2-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

The exact values depend on your domain and your Microsoft 365 tenant. The Defender portal generates the exact records for your domain; do not try to construct them manually. See Microsoft's DKIM configuration documentation for the full official reference.

Why two selectors?

The two selectors allow Microsoft to rotate keys without disrupting email delivery. While one selector is the active signing key, the other is available as a backup. When Microsoft rotates keys, they switch between selectors. If both CNAME records are not published, key rotation fails and DKIM breaks until the missing record is added.

Before you enable DKIM

There are three things to verify before touching the Defender portal.

Step 1: Open Microsoft 365 Defender portal

Where DKIM settings are located:

1. 1.Go to https://security.microsoft.com
2. 2.In the left navigation, go to Email & collaboration
3. 3.Select Policies & rules
4. 4.Select Threat policies
5. 5.Under Rules, select Email authentication settings
6. 6.Click the DKIM tab

You will see a list of all custom domains associated with your Microsoft 365 tenant. Each domain shows its current DKIM status: Enabled, Disabled, or No DKIM keys saved.

For domains showing “No DKIM keys saved,” you need to add the CNAME records first. The portal shows you the exact records to add. Click on the domain name to see the CNAME values.

Step 2: Create required CNAME records

After clicking on your domain in the DKIM settings, the portal shows you two CNAME records. Copy them exactly. They follow this format:

What the components mean:

selector1._domainkey and selector2._domainkey are the hostnames. In your DNS provider, the hostname field should be set to selector1._domainkey (without your domain appended, since your DNS provider adds that automatically). Some providers need the full hostname selector1._domainkey.yourdomain.com.

The value (Points To) is generated by Microsoft and combines your domain name with your Microsoft 365 tenant identifier. It looks something like:

selector1-yourcompany-com._domainkey.yourtenantname.onmicrosoft.com

The hyphenated version of your domain in the value is Microsoft's format. yourcompany.com becomes yourcompany-com. Periods in the domain name become hyphens. This is expected. Copy these values directly from the Defender portal. Do not try to construct them manually. The tenant name and exact format must match what Microsoft expects.

Step 3: Add DKIM records to DNS

Add both CNAME records to your DNS provider. The record type is CNAME, not TXT.

Cloudflare

1. 1.Log in to Cloudflare and select your domain
2. 2.Go to DNS > Records
3. 3.Click Add record
4. 4.Type: CNAME
5. 5.Name: selector1._domainkey
6. 6.Target: paste the selector1 value from the Defender portal
7. 7.Proxy status: DNS only (orange cloud OFF, grey cloud ON) -- this is critical; CNAME records for DKIM must not be proxied through Cloudflare
8. 8.TTL: Auto
9. 9.Click Save
10. 10.Repeat for selector2

Namecheap

1. 1.Log in to Namecheap and go to Domain List
2. 2.Click Manage next to your domain
3. 3.Go to Advanced DNS
4. 4.Click Add New Record
5. 5.Type: CNAME Record
6. 6.Host: selector1._domainkey
7. 7.Value: paste the selector1 value from the Defender portal
8. 8.TTL: Automatic
9. 9.Click the green checkmark to save
10. 10.Repeat for selector2

GoDaddy

1. 1.Log in to GoDaddy and go to My Products
2. 2.Select your domain and click DNS
3. 3.Click Add under Records
4. 4.Type: CNAME
5. 5.Name: selector1._domainkey
6. 6.Value: paste the selector1 value from the Defender portal
7. 7.TTL: 1 Hour
8. 8.Click Save
9. 9.Repeat for selector2

Squarespace Domains

1. 1.Open your Squarespace Domains dashboard and select your domain
2. 2.Go to DNS
3. 3.Scroll to Custom records and click Add record
4. 4.Type: CNAME
5. 5.Host name: selector1._domainkey
6. 6.Data: paste the selector1 value from the Defender portal
7. 7.TTL: 3600
8. 8.Click Save
9. 9.Repeat for selector2

Step 4: Enable DKIM in Microsoft 365

After adding both CNAME records to DNS, wait for propagation (typically 15-60 minutes, up to 48 hours for full global propagation) before enabling DKIM in the portal.

Exact steps:

1. 1.Return to https://security.microsoft.com
2. 2.Navigate to Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM
3. 3.Click on your domain
4. 4.In the panel that opens, toggle Sign messages for this domain with DKIM signatures to ON
5. 5.Click Save

If the toggle fails with an error:

The most common error at this stage is “DKIM keys for this domain could not be saved. Please try again.” This almost always means the CNAME records have not propagated yet or were entered incorrectly.

Check propagation at Vortenza SPF DKIM DMARC Checker. If the DKIM records are not yet visible, wait another 30-60 minutes and try again. If they show up in the checker but the portal still fails, verify that the CNAME values match exactly what the Defender portal showed, including the hyphens and the correct tenant name.

After successful activation:

The portal shows your domain's DKIM status as Enabled with a green indicator. Microsoft 365 will now sign all outgoing emails from your domain with a DKIM signature.

Step 5: Verify DKIM is working

Verification has two parts: confirming the DNS records are visible and confirming signatures are appearing in outgoing emails.

DNS verification:

Enter your domain at the Vortenza SPF DKIM DMARC Checker. The DKIM check should show both selector1 and selector2 CNAME records resolving correctly, and the DKIM status should show as passing.

Email header verification:

Send a test email from your Microsoft 365 account to a Gmail address you control. Open the email in Gmail, click the three dots next to Reply, and select “Show original.” Look for a line like:

Authentication-Results: mx.google.com;
  dkim=pass header.i=@yourdomain.com header.s=selector1

dkim=pass confirms the signature is valid. The header.s=selector1 or selector2 shows which selector was used.

Command line verification (optional):

nslookup -type=CNAME selector1._domainkey.yourdomain.com

Common DKIM errors

The Cloudflare proxying issue is worth calling out specifically because it is easy to miss. Cloudflare's proxy (the orange cloud) intercepts DNS lookups for records it manages. For DKIM CNAME records, proxying breaks the lookup chain because receiving servers need to follow the CNAME to Microsoft's key servers. The grey cloud (DNS only) lets the lookup pass through correctly.

DKIM vs SPF vs DMARC comparison

A practical observation on relative value: SPF is necessary but attackers can work around SPF-only domains through header manipulation. DKIM is what DMARC uses to close that gap. DMARC without DKIM is weak because it relies entirely on SPF, which breaks on email forwarding. The stack only works as intended when all three are in place.

Microsoft 365 and DMARC rollout

After DKIM is active and passing, DMARC is the logical next step. Microsoft 365 does not require DMARC separately for your tenant, but adding DMARC to your domain gives you enforcement and reporting.

Recommended rollout timeline:

The reports from p=none are the data you need before enforcing. They show you every server sending email using your domain, whether each passes or fails, and what the policy would have done if it were enforced. Skipping this monitoring phase and jumping to p=reject is the most common mistake in DMARC rollout.

Use the Vortenza DMARC Record Generator to build the correct DMARC TXT record for your domain. And the full step-by-step process is in the DMARC setup guide.

DKIM best practices for 2026

One-minute DKIM audit

Use this before any major campaign or after any infrastructure change.

DKIM health benchmarks

Source: Google Postmaster Tools thresholds (complaint rate, reputation). Inbox placement benchmarks from Mailchimp 2024 Email Marketing Benchmarks. Authentication coverage based on Google and Yahoo February 2024 bulk sender requirements.

A DKIM pass rate below 80% is a signal that something is misconfigured or that a significant share of your email comes from sources where DKIM is not set up. Common causes: a third-party sending tool that sends on your behalf without using your domain's DKIM, email forwarding scenarios, or a recently added sending domain where DKIM was not enabled.

Quick answers

Optimized for ChatGPT, Gemini, Perplexity, Claude, and Google AI Overviews. All information current as of June 2026.

Frequently asked questions

Tools used in this guide

Related guides