# DKIM record for Microsoft 365 URL: https://iblockspam.com/dkim/microsoft-365 Last updated: 2026-10-09 Record type: CNAME Selectors: selector1, selector2 Key managed by: Provider (CNAME delegation) Microsoft 365 (Office 365) signs mail from a custom domain once you publish two CNAME records, `selector1._domainkey` and `selector2._domainkey`, and turn signing on in the Microsoft Defender portal. Microsoft holds the private keys. Custom domains added from May 2025 point to a target ending in `dkim.mail.microsoft`; older custom domains point to `onmicrosoft.com`. ## DNS records - Selector 1, custom domains added from May 2025 (CNAME, host selector1._domainkey): `selector1-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft` The letter before `-v1` (here `n`) is a partition Microsoft assigns, such as `n` or `r`. You can't choose it, so copy it rather than guess. - Selector 2, custom domains added from May 2025 (CNAME, host selector2._domainkey): `selector2-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft` - Selector 1, custom domains added before May 2025 (CNAME, host selector1._domainkey): `selector1-contoso-com._domainkey.contoso.onmicrosoft.com` Existing custom domains keep this older format. Microsoft says the old and new formats can't coexist for the same selector. - Selector 2, custom domains added before May 2025 (CNAME, host selector2._domainkey): `selector2-contoso-com._domainkey.contoso.onmicrosoft.com` ## Set it up and turn on signing - In the Microsoft Defender portal, go to **Email & collaboration > Policies & rules > Threat policies > Email authentication settings** and open the **DKIM** tab. - Select your custom domain. It shows the toggle as Disabled and the status NoDKIMKeys. Slide the toggle: a "Client error" dialog appears with the two CNAME values and the status becomes CnameMissing. The error is expected; it means the keys exist but DNS doesn't point to them yet. - Open the domain's details, copy both values under **Publish CNAMEs**, and create the two CNAME records at your DNS host. Microsoft suggests a TTL of at least 3600 seconds. - When DNS has updated (Microsoft allows anywhere from a few minutes to 48 hours), turn on **Sign messages for this domain with DKIM signatures**. The status should read "Signing DKIM signatures for this domain". - In Exchange Online PowerShell, `Get-DkimSigningConfig -Identity contoso.com | Format-List Selector1CNAME,Selector2CNAME` shows the targets, and `Set-DkimSigningConfig -Identity contoso.com -Enabled $true` turns signing on. ## DMARC alignment Microsoft signs mail from your `contoso.onmicrosoft.com` domain automatically, but says no DKIM signing happens for custom domains until you set it up. Until then DMARC can only pass for `contoso.com` through SPF, which forwarding breaks. Once signing is on, signatures carry `d=contoso.com` and align with your From address. Every subdomain you send from needs its own DKIM configuration, and Microsoft advises against publishing DKIM records for parked domains that send no mail. ## Key length and rotation Microsoft's PowerShell reference gives 1024 bits as the default key size and supports 1024 or 2048 (RSA only; Ed25519 isn't supported). **Rotate DKIM keys** in the portal, or `Rotate-DkimSigningConfig -Identity contoso.com -KeySize 2048`, moves signing to the other selector. The new key starts signing after four days (96 hours), and you can't start another rotation until then. A new key size applies to the next selector at the first rotation, so rotate once after choosing 2048. Because both names are CNAMEs, rotation needs no DNS change, which is why a missing `selector2` record breaks it. Microsoft notes there is currently no automatic rotation for the `onmicrosoft.com` domain. ## Common mistakes - **A TXT record instead of a CNAME.** Microsoft lists TXT as not supported for these names; it doesn't publish a key for you to paste. - **The full name in the host field.** Enter `selector1._domainkey` only. Microsoft notes that most DNS hosts, GoDaddy among them, add your domain, so `selector1._domainkey.contoso.com` becomes `selector1._domainkey.contoso.com.contoso.com`. In Route 53, Microsoft says to end the target with a period. - **Copying a target from an old guide.** Domains added since May 2025 use `dkim.mail.microsoft` targets. Copy what the portal shows for your domain. - **Cloudflare proxy left on.** Set both CNAMEs to DNS only; a proxied record doesn't resolve to Microsoft's key. - **Testing with an internal message.** Microsoft doesn't add a DKIM signature when sender and recipient are in the same organization, so test by sending to an outside mailbox. **Q: Why does Microsoft 365 show a Client error when I turn on DKIM?** Because the CNAME records don't exist yet. Sliding the toggle creates the keys, shows the two values you need, and sets the status to CnameMissing. Publish both CNAMEs at your DNS host, wait for DNS to update, then turn signing on again. **Q: Which Microsoft 365 DKIM target format applies to my domain?** Custom domains added from May 2025 use targets ending in `dkim.mail.microsoft`. Domains added earlier keep targets ending in `onmicrosoft.com`. Don't convert one into the other: copy what the Defender portal or `Get-DkimSigningConfig` shows for your domain. **Q: Do I need to publish DKIM records for my onmicrosoft.com domain?** No. Microsoft signs mail from your `contoso.onmicrosoft.com` domain automatically and manages its keys. Only the custom domains you add need the two CNAMEs, and only the ones that actually send mail. **Q: Does Microsoft 365 support 2048-bit DKIM keys?** Yes. Microsoft supports RSA keys of 1024 or 2048 bits, but not Ed25519. A switch to 2048 bits applies to the next selector at the next rotation, so rotate once after changing it and allow four days for the new key to start signing. Sources: - Microsoft Learn: Set up DKIM to sign mail from your cloud domain: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure - Microsoft Learn: New-DkimSigningConfig (Exchange PowerShell): https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-dkimsigningconfig - Microsoft Learn: Rotate-DkimSigningConfig (Exchange PowerShell): https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/rotate-dkimsigningconfig --- Source: iBlockSpam, https://iblockspam.com/dkim/microsoft-365 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt