# How do you fix the Microsoft 365 DKIM CNAME record error?

URL: https://iblockspam.com/blog/microsoft-365-dkim-cname-record-error
Last updated: 2026-10-22
Published: 2026-10-22
Topic: SPF, DKIM & DMARC
Author: iBlockSpam Team

> Microsoft 365 won't enable DKIM and shows CnameMissing or a CNAME record error? The causes in order of likelihood, how to check DNS, and the fix for each.

## Short answer

Microsoft 365 shows CnameMissing when it can't find the selector1._domainkey and selector2._domainkey CNAME records for your domain. Usually the records are new and not detected yet, the host name has the domain twice, or the target was typed instead of copied. Copy both values from Get-DkimSigningConfig, fix DNS, then enable signing again.

You go to turn on DKIM for a custom domain in Microsoft 365 and it refuses: an error dialog full of record values, and a status of **CnameMissing** that won't go away. The cause is almost always in DNS, not in Microsoft 365. This guide starts from what you see, lists the causes in the order we'd check them, and gives the fix for each. If you haven't set DKIM up yet, start with our [DKIM setup guide for Microsoft 365 and Google Workspace](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace).

## What does the Microsoft 365 DKIM CNAME error look like?

The error means Microsoft 365 looked up your two [DKIM CNAME records](https://iblockspam.com/blog/dkim-cname-vs-txt-record) and didn't find the values it expects. Where you see it depends on where you tried to enable signing.

In the Defender portal (**Email & collaboration** > **Policies & rules** > **Threat policies** > **Email authentication settings** > **DKIM**, or `https://security.microsoft.com/authentication`), Microsoft documents that sliding the toggle opens a **Client error** dialog. Microsoft says the error "contains the required values to use in the two CNAME records you create at the domain registrar for the domain along with a lot of other text." You don't need to copy it: the same values are easier to read in the domain's details flyout, or in PowerShell (see below). Back on the DKIM tab, the domain's **Status** changes to `CnameMissing` and the toggle stays **Disabled**.

The status values you can see come from [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure):

| Where | Status you see | What it means |
|---|---|---|
| DKIM tab, row | `NoDKIMKeys` | No keys created yet; nothing to publish |
| Domain flyout | "No DKIM keys saved for this domain" | Same as above, with a **Create DKIM keys** button |
| DKIM tab, row | `CnameMissing` | Keys exist, but Microsoft can't find the matching CNAMEs |
| Domain flyout | "Signing DKIM signatures for this domain" | Working |
| PowerShell | `Enabled: True`, `Status: Valid` | Working |

In Exchange Online PowerShell, `Set-DkimSigningConfig -Identity example.com -Enabled $true` fails with an error that contains the values to use. Microsoft's advice there is blunt: "Check for typos in the values at the domain registrar (easy to do with the dashes, periods, and underlines!), wait a while longer, and then run the command again."

## What causes CnameMissing, most likely first?

Work down this list. Most domains are fixed by one of the first three.

1. **The records are new and haven't been detected yet.** Microsoft says detection takes "a few minutes (or possibly longer)", and that DNS propagation can take from a few minutes to 48 hours depending on the provider and TTL.
2. **The host name has the domain twice.** Many DNS hosts append your domain automatically. Enter `selector1._domainkey.example.com` there and the record really lives at `selector1._domainkey.example.com.example.com`. Microsoft names GoDaddy as one host that does this.
3. **The target was typed or built by hand.** Common slips: dots kept instead of dashes (`example.com` must become `example-com`), the whole `onmicrosoft.com` name used instead of just its prefix, or the partition letter left out.
4. **The record is in the wrong DNS zone.** You edited the zone at your registrar, but your name servers point somewhere else, such as Cloudflare or your web host. Microsoft's table for a status still stuck after 48 hours says the records "are incorrect or in the wrong zone."
5. **A TXT record (or another record) sits at the same name.** Microsoft calls a TXT key at `selector1._domainkey` a mistake that keeps the status at CnameMissing. DNS also forbids mixing: [RFC 1034](https://www.rfc-editor.org/rfc/rfc1034.html#section-3.6.2) says "If a CNAME RR is present at a node, no other data should be present", so most hosts won't save the CNAME until you delete the old record.
6. **Only one selector was created.** Microsoft requires both. Without `selector2`, key rotation fails, and Microsoft says the portal may warn about an incomplete configuration.
7. **A trailing dot problem.** Some hosts need a trailing dot on the target to treat it as a full name. Others add it, and an extra one corrupts the value.
8. **Cloudflare proxy is on.** Microsoft tells Cloudflare users to set DKIM CNAMEs to **DNS only** (grey cloud), because a proxied CNAME returns Cloudflare's addresses instead of the target.

### Old and new target formats

Microsoft changed the target format for new custom domains in May 2025:

| Domain added | Target pattern |
|---|---|
| From May 2025 | `selector1-example-com._domainkey.<prefix>.<x>-v1.dkim.mail.microsoft` |
| Before May 2025 | `selector1-example-com._domainkey.<prefix>.onmicrosoft.com` |

`<prefix>` is the custom part of your initial `onmicrosoft.com` domain, and `<x>` is a letter Microsoft assigns, such as `n` or `r`. Microsoft says "the old and new formats can't coexist for the same selector." A record copied from an old blog post or another tenant will resolve and still be wrong. Use what your tenant shows.

## How do you check the records Microsoft expects?

Ask Microsoft 365, then ask DNS, and compare.

1. **Get the expected values.** In Exchange Online PowerShell, run:

   ```powershell
   Get-DkimSigningConfig -Identity example.com |
     Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME
   ```

   If the domain isn't listed at all, create the configuration first with `New-DkimSigningConfig -DomainName example.com -Enabled $false`. Its default key size is 1024 bits; add `-KeySize 2048` for a 2048-bit key.
2. **Query public DNS.** On Windows, `nslookup -type=CNAME selector1._domainkey.example.com`. On macOS or Linux:

   ```
   dig CNAME selector1._domainkey.example.com +short
   dig CNAME selector2._domainkey.example.com +short
   ```

   A correct answer (example) is a single line such as `selector1-example-com._domainkey.example.n-v1.dkim.mail.microsoft.`
3. **Compare character by character.** The DNS answer must match `Selector1CNAME` and `Selector2CNAME`, apart from a final dot.
4. **Read what's wrong from the answer:**

| DNS answer for `selector1._domainkey.example.com` | Cause | Fix |
|---|---|---|
| Nothing (NXDOMAIN) | Not published, wrong zone, or name doubled | Check the host field and which provider your name servers point to |
| A TXT record starting `v=DKIM1` | TXT published instead of CNAME | Delete it; create the CNAME |
| A CNAME with a different target | Typed, old-format or another tenant's value | Replace with the exact `Selector1CNAME` value |
| Cloudflare IP addresses | Proxied record | Switch to **DNS only** |
| Correct CNAME, but only for selector1 | selector2 missing | Create selector2 too |

Our [DKIM Checker](https://iblockspam.com/tools/dkim-checker) shows the same thing from outside your network. Enter your domain and `selector1`, then `selector2`.

## How do you fix it and turn DKIM signing on?

Once DNS returns the right answer for both selectors:

1. Set both CNAMEs to the exact values, with a TTL of at least 3600 seconds. Microsoft lists TTLs as low as 60 or 300 seconds as a cause of intermittent `dkim=temperror` results at receivers.
2. Wait until both names resolve at public resolvers, not just at your DNS host's own preview.
3. Return to the domain's flyout on the DKIM tab and select **Sign messages for this domain with DKIM signatures**, or run `Set-DkimSigningConfig -Identity example.com -Enabled $true`. Microsoft notes: "It may take several minutes to synchronize the status change."
4. Confirm the status is **Signing DKIM signatures for this domain** (portal) or `Valid` (PowerShell).
5. Send a test message to a mailbox at another provider and check `dkim=pass` with `header.d=example.com` in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).

If the toggle flips straight back to **Disabled** while the records are correct, Microsoft lists that as rare and says to contact Microsoft Support with the output of `Get-DkimSigningConfig -Identity example.com`.

### How do common DNS hosts handle the host field?

| DNS host | Host/Name field | Note |
|---|---|---|
| GoDaddy | `selector1._domainkey` | Appends the zone; no trailing dot needed. See our [GoDaddy DNS guide](https://iblockspam.com/blog/add-email-dns-records-godaddy) |
| Namecheap | `selector1._domainkey` | Appends the zone; no trailing dot needed. See our [Namecheap DNS guide](https://iblockspam.com/blog/add-email-dns-records-namecheap) |
| Cloudflare | `selector1._domainkey` | Appends the zone; set proxy status to **DNS only**. See our [Cloudflare guide](https://iblockspam.com/blog/add-dmarc-spf-dkim-records-cloudflare) |
| Amazon Route 53 | `selector1._domainkey` | Microsoft says the target needs a trailing dot, or Route 53 appends the hosted zone name |
| Azure DNS | `selector1._domainkey` | Microsoft's example uses a **+ Record set** of type CNAME; don't add a trailing dot |

These entries follow the DNS provider summary table in [Microsoft's DKIM article](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure) at the time of writing (October 2026). Host control panels change, so check your host's current help page if a field looks different. When in doubt, create the record, then query it with `dig` before you go back to Microsoft 365.

## Why does DKIM still fail after the status says Valid?

A Valid status means Microsoft can sign. It doesn't guarantee every message passes DKIM and DMARC. Microsoft's own troubleshooting table lists three follow-on problems:

- **DKIM passes but DMARC fails.** The `d=` domain doesn't align with the From domain, usually because mail comes from a subdomain or another domain with no DKIM configuration of its own. Each sending domain and subdomain needs its own pair of CNAMEs.
- **DKIM works for one domain but not another.** Same cause: every domain in the tenant has its own records.
- **DKIM fails after forwarding.** Something modified the message on the way. See [why DKIM body hash verification fails](https://iblockspam.com/blog/dkim-fail-body-hash-did-not-verify).

Before you enforce DMARC, check that your custom domain, not `onmicrosoft.com`, is the signing domain. Our [DMARC setup guide for Microsoft 365](https://iblockspam.com/blog/dmarc-setup-microsoft-365) covers the rest.

## Next steps

1. Run `Get-DkimSigningConfig` and list every domain still at `NoDKIMKeys` or `CnameMissing`.
2. For each one, query both selectors with the [DKIM Checker](https://iblockspam.com/tools/dkim-checker) and fix the record using the table above.
3. Enable signing, confirm `Valid`, and send a test to an outside mailbox.
4. Rotate any 1024-bit key to 2048 bits with `Rotate-DkimSigningConfig -KeySize 2048`, as covered in [DKIM key rotation](https://iblockspam.com/blog/dkim-key-rotation).
5. Check the provider-specific record format on our [Microsoft 365 DKIM page](https://iblockspam.com/dkim/microsoft-365).

If you're also putting filtering in front of Microsoft 365, our [Microsoft 365 platform page](https://iblockspam.com/platforms/microsoft-365) explains how iBlockSpam's guided setup fits alongside DKIM. Browse our other [SPF, DKIM and DMARC guides](https://iblockspam.com/blog/topic/authentication).

## Frequently asked questions

### How long does Microsoft 365 take to detect new DKIM CNAME records?

Microsoft says it takes a few minutes, or possibly longer, for Microsoft 365 to detect new DKIM CNAME records, and that DNS propagation can take from a few minutes to 48 hours depending on the DNS provider and TTL. If the status is still CnameMissing after 48 hours, the records are almost certainly wrong or in the wrong DNS zone.

### Can I publish the Microsoft 365 DKIM key as a TXT record instead of a CNAME?

No. Microsoft 365 keeps the private keys and rotates them itself, so it expects CNAME records that point to keys it hosts. Microsoft lists a TXT record at selector1._domainkey as a mistake that leaves the status at CnameMissing. Delete the TXT record and create the CNAME.

### Why does selector1 resolve but Microsoft 365 still says CnameMissing?

Check selector2. Microsoft requires both CNAME records, because the inactive selector is used at the next key rotation. Also compare the target with the Selector1CNAME value from Get-DkimSigningConfig character by character. A target that resolves but differs from Microsoft's expected value, such as an old-format target, doesn't count.

### Do I need new DKIM CNAME records for each Microsoft 365 domain?

Yes. Each custom domain and each subdomain that sends mail from Microsoft 365 needs its own pair of selector1 and selector2 CNAME records, created in that domain's DNS zone, with targets that include that domain. Records for example.com don't cover sales.example.com or a second domain in the same tenant.

### What does the CNAME target in Microsoft 365 DKIM records mean?

For domains added from May 2025, the target is selector1-<domain-with-dashes>._domainkey.<initial-domain-prefix>.<letter>-v1.dkim.mail.microsoft. The letter is a partition character Microsoft assigns. Older domains use a target ending in your onmicrosoft.com domain. Always copy the value Microsoft shows rather than building it.

## Sources

- [Microsoft Learn: Set up DKIM to sign mail from your Microsoft 365 domain (including Troubleshoot DKIM DNS configuration)](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure)
- [Microsoft Learn: Get-DkimSigningConfig](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-dkimsigningconfig?view=exchange-ps)
- [RFC 1034: Domain Names, Concepts and Facilities (section 3.6.2, CNAME)](https://www.rfc-editor.org/rfc/rfc1034.html#section-3.6.2)
- [RFC 6376: DomainKeys Identified Mail (DKIM) Signatures](https://www.rfc-editor.org/rfc/rfc6376.html)
- [Cloudflare Docs: Proxy status](https://developers.cloudflare.com/dns/proxy-status/)

## Free tools for this guide

- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-dkim-cname-record-error (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt