Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for Dynamics 365 Customer Insights - Journeys

Dynamics 365 Customer Insights - Journeys sets up DKIM through its domain authentication wizard: after an ownership TXT record, you add two CNAMEs, CNAME1 and CNAME2, whose host part looks like Microsoft's example namkey1._domainkey, then an envelope-from CNAME for SPF. Copy every value from the wizard and select Verify.

Record type
CNAME
Selectors
CNAME1 and CNAME2 from the wizard (e.g. namkey1)
Private key held by
Provider (CNAME delegation)

The DNS records

The wizard generates all four records for your domain. Microsoft's example host part is shown; copy the rest exactly.

Ownership

Type: TXT · Host: @ 

<TXT value shown in the wizard>

If the name already has a CNAME, Microsoft lets you put this TXT record at dynmktown instead.

DKIM: CNAME1

Type: CNAME · Host: namkey1._domainkey 

<CNAME1 value shown in the wizard>

Microsoft's example host part. For a sending subdomain such as test.dynmkt.com, the full name is namkey1._domainkey.test.dynmkt.com.

DKIM: CNAME2

Type: CNAME · Host: <CNAME2 host part shown in the wizard> 

<CNAME2 value shown in the wizard>

Envelope-from (Return-Path)

Type: CNAME · Host: <envelope-from host shown in the wizard> 

<envelope-from value shown in the wizard>

This record is for SPF and Return-Path alignment, not DKIM.

Set it up and turn on signing

  1. Go to Settings > Email marketing > Domain authentication and select New on the command bar.
  2. Enter the domain from your From addresses and choose whether it is for email sending, form hosting or both. Form hosting alone needs no DNS records.
  3. Add the ownership TXT record with the Copy buttons, then the two DKIM CNAMEs, then the envelope-from CNAME, as each wizard step shows them.
  4. Review the records and select Verify. The dashboard marks each record and shows which one failed, if any.
  5. If the status isn't Confirmed, wait (Microsoft allows up to 24 hours for DNS) and select Confirm. Then set the domain as your default sending domain.

DMARC alignment

Authentication makes the DKIM signature and the Return-Path use your domain, so both align with the From address. Without it, Customer Insights - Journeys rewrites the From address to an authenticated domain of your instance, such as MyName@contoso.s01.dyn365mktg.com, and the error check blocks going live with an unregistered domain. Use the full domain from your addresses: contoso.com and www.contoso.com are separate domains.

Key length and rotation

Both DKIM records are CNAMEs to names Microsoft generates, so the keys are managed on Microsoft's side and nothing in your zone has to change when they do. Microsoft's articles don't state a key length or rotation schedule. With modernized business units, each authenticated domain can belong to one business unit or be shared across the organization.

Common mistakes

  • Leaving out the subdomain. For mail from test.dynmkt.com, the CNAME must sit under test.dynmkt.com, not the root.
  • Checking the wrong record type. Microsoft says to look up TXT for ownership and CNAME for DKIM and envelope-from.
  • Sending production mail from dyn365mktg.com. Microsoft says the built-in domain is for testing only.
  • A TXT record where a CNAME already exists. Use the dynmktown alternative Microsoft documents.

Check your Dynamics 365 Customer Insights DKIM key

Enter your domain and the selector from your Dynamics 365 Customer Insights account. Free, reads public DNS only.

Frequently asked questions

Which DNS records does Customer Insights - Journeys need for DKIM?

Two CNAMEs, called CNAME1 and CNAME2 in the domain authentication wizard. Microsoft's example host part is namkey1._domainkey. The wizard also asks for an ownership TXT record and an envelope-from CNAME.

Why does my Customer Insights - Journeys domain fail authentication?

Usually a record is missing, still updating, or under the wrong name. Microsoft suggests checking each hostname with a DNS propagation tool, allowing up to 24 hours, and selecting Confirm if the DNS status isn't Confirmed yet.

Can I prove domain ownership without a TXT record at the root?

Yes. If a CNAME already exists at that name, Microsoft lets you add the ownership TXT record at dynmktown.contoso.com instead, or dynmktown.mail.contoso.com for a subdomain.

Sources

Checked against Dynamics 365 Customer Insights's documentation on October 22, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for Dynamics 365 Customer Insights

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated