How to set up DKIM for a custom domain in Microsoft 365

Setting up DKIM for a custom domain in Microsoft 365 is two CNAME records in your DNS pointing at Microsoft's keys, then a toggle in the Defender portal. Once on, every message Exchange Online sends from that domain carries a signature that receivers can verify against your DNS — which is what makes DMARC enforceable and what stops your legitimate mail landing in junk at Gmail and Yahoo, both of which now require it for bulk senders.

DKIM is one of three email-authentication mechanisms; SPF and DMARC are the other two and the domains and DNS setup guide puts them together. If the domain is being added fresh, do this before the MX record changes, per adding a domain without downtime.

Prerequisites

The custom domain verified in Microsoft 365 (Settings → Domains shows it healthy).
Security Administrator or Exchange Administrator for the Defender portal; the DKIM page lives under Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
Access to the domain's DNS to add CNAME records.
Exchange Online PowerShell if you prefer the command line.

Steps

Progress 0/4

1.Get the CNAME targets↓
2.Publish the CNAME records↓
3.Enable signing↓
4.Rotate keys (later, on a schedule)↓

Progress is saved in this browser only.

1. Get the CNAME targets

In the Defender portal's DKIM page, select the domain and click Create DKIM keys if no keys exist. The portal shows two records. They follow a fixed pattern, so you can also derive them:

| Host name | Points to | | --- | --- | | selector1._domainkey | selector1-<domain-with-dashes>._domainkey.<tenant>.onmicrosoft.com | | selector2._domainkey | selector2-<domain-with-dashes>._domainkey.<tenant>.onmicrosoft.com |

For contoso.com in tenant contoso.onmicrosoft.com, selector1 points to selector1-contoso-com._domainkey.contoso.onmicrosoft.com. Dots in the domain become dashes. Copy the exact values from the portal rather than typing them; the tenant part is your initial onmicrosoft.com domain, which may not match the display name.

Or from PowerShell:

PowerShell

Connect-ExchangeOnline
New-DkimSigningConfig -DomainName contoso.com -Enabled $false   # creates keys if missing
Get-DkimSigningConfig -Identity contoso.com | Format-List Selector1CNAME,Selector2CNAME

2. Publish the CNAME records

In your DNS provider, add two CNAME records with the host names and targets above. TTL 3600 is fine. Do not add TXT records — Microsoft holds the actual keys behind the CNAME so it can rotate them for you.

Check propagation before moving on:

Code

nslookup -type=CNAME selector1._domainkey.contoso.com
nslookup -type=CNAME selector2._domainkey.contoso.com

Both must resolve to the targets from step 1.

3. Enable signing

Back on the DKIM page, select the domain and switch Sign messages for this domain with DKIM signatures to Enabled. Or:

PowerShell

Set-DkimSigningConfig -Identity contoso.com -Enabled $true

If the portal reports an error, one of the CNAMEs is not resolving correctly yet; the message names the selector.

4. Rotate keys (later, on a schedule)

Microsoft rotates keys automatically, alternating selectors; the CNAMEs never change. Use Rotate DKIM keys in the portal (or Rotate-DkimSigningConfig) after a suspected key compromise or when moving to 2048-bit keys, which is the default for new keys. Rotation takes up to four days to complete; the old selector keeps validating in the meantime.

Verify

Send a message from the domain to an external mailbox you control (Gmail is convenient) and open the original/headers. Authentication-Results should show dkim=pass header.d=contoso.com and header.s=selector1 or selector2.
In the Defender portal the domain shows Signing enabled with a green status.
Once DMARC reporting is in place, aggregate reports show DKIM-aligned pass for mail from Exchange Online; anything failing DKIM from your domain is another sending service to configure.

Roll back

Disable signing in the portal or with Set-DkimSigningConfig -Enabled $false. Mail reverts to being signed with the onmicrosoft.com domain key within minutes — deliverability drops, but nothing breaks. Leave the CNAME records in place; removing them while signing is enabled causes receivers to fail DKIM verification on mail already in transit.

Frequently asked questions

Is DKIM enabled by default in Microsoft 365?

Only for the initial onmicrosoft.com domain. Every custom domain you add needs two CNAME records published in your DNS and DKIM explicitly enabled in the Defender portal. Until then, mail from that domain is signed with the onmicrosoft.com key, which does not align with your domain for DMARC.

Why does the Defender portal say it can't enable DKIM?

The two CNAME records are missing, wrong, or not yet propagated. The error names which selector failed. Check with nslookup -type=CNAME selector1._domainkey.yourdomain.com — it must return the exact target from the portal, including the -onmicrosoft-com suffix. Some DNS providers add the domain automatically, giving a doubled domain in the record.

Does DKIM in Microsoft 365 cover mail sent by third-party services from my domain?

No. Microsoft 365 signs only what leaves Exchange Online. A marketing platform, ticketing tool, or payroll provider sending as your domain needs its own DKIM selector published in your DNS and configured in that service. DMARC reports are how you find out which ones you have forgotten.