DKIM record for Microsoft 365

The DNS records

Microsoft generates the targets for your tenant, so copy yours from the Defender portal or from Get-DkimSigningConfig. The examples use the custom domain contoso.com and the initial domain contoso.onmicrosoft.com.

Selector 1, custom domains added from May 2025

Type: CNAME · Host: selector1._domainkey Copy

selector1-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft

The letter before -v1 (here n) is a partition Microsoft assigns, such as n or r. You can't choose it, so copy it rather than guess.

Selector 2, custom domains added from May 2025

Type: CNAME · Host: selector2._domainkey Copy

selector2-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft

Selector 1, custom domains added before May 2025

Type: CNAME · Host: selector1._domainkey Copy

selector1-contoso-com._domainkey.contoso.onmicrosoft.com

Existing custom domains keep this older format. Microsoft says the old and new formats can't coexist for the same selector.

Selector 2, custom domains added before May 2025

Type: CNAME · Host: selector2._domainkey Copy

selector2-contoso-com._domainkey.contoso.onmicrosoft.com

Set it up and turn on signing

1. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings and open the DKIM tab.
2. Select your custom domain. It shows the toggle as Disabled and the status NoDKIMKeys. Slide the toggle: a "Client error" dialog appears with the two CNAME values and the status becomes CnameMissing. The error is expected; it means the keys exist but DNS doesn't point to them yet.
3. Open the domain's details, copy both values under Publish CNAMEs, and create the two CNAME records at your DNS host. Microsoft suggests a TTL of at least 3600 seconds.
4. When DNS has updated (Microsoft allows anywhere from a few minutes to 48 hours), turn on Sign messages for this domain with DKIM signatures. The status should read "Signing DKIM signatures for this domain".
5. In Exchange Online PowerShell, Get-DkimSigningConfig -Identity contoso.com | Format-List Selector1CNAME,Selector2CNAME shows the targets, and Set-DkimSigningConfig -Identity contoso.com -Enabled $true turns signing on.

DMARC alignment

Microsoft signs mail from your contoso.onmicrosoft.com domain automatically, but says no DKIM signing happens for custom domains until you set it up. Until then DMARC can only pass for contoso.com through SPF, which forwarding breaks. Once signing is on, signatures carry d=contoso.com and align with your From address. Every subdomain you send from needs its own DKIM configuration, and Microsoft advises against publishing DKIM records for parked domains that send no mail.

Key length and rotation

Microsoft's PowerShell reference gives 1024 bits as the default key size and supports 1024 or 2048 (RSA only; Ed25519 isn't supported). Rotate DKIM keys in the portal, or Rotate-DkimSigningConfig -Identity contoso.com -KeySize 2048, moves signing to the other selector. The new key starts signing after four days (96 hours), and you can't start another rotation until then. A new key size applies to the next selector at the first rotation, so rotate once after choosing 2048. Because both names are CNAMEs, rotation needs no DNS change, which is why a missing selector2 record breaks it. Microsoft notes there is currently no automatic rotation for the onmicrosoft.com domain.

Common mistakes

• A TXT record instead of a CNAME. Microsoft lists TXT as not supported for these names; it doesn't publish a key for you to paste.
• The full name in the host field. Enter selector1._domainkey only. Microsoft notes that most DNS hosts, GoDaddy among them, add your domain, so selector1._domainkey.contoso.com becomes selector1._domainkey.contoso.com.contoso.com. In Route 53, Microsoft says to end the target with a period.
• Copying a target from an old guide. Domains added since May 2025 use dkim.mail.microsoft targets. Copy what the portal shows for your domain.
• Cloudflare proxy left on. Set both CNAMEs to DNS only; a proxied record doesn't resolve to Microsoft's key.
• Testing with an internal message. Microsoft doesn't add a DKIM signature when sender and recipient are in the same organization, so test by sending to an outside mailbox.