Skip to content
← Back to the guide

How to set up DKIM for a custom domain in Microsoft 365

8slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 8

How to set up DKIM for a custom domain in Microsoft 365

How to set up DKIM signing for a custom domain in Microsoft 365: the two CNAME records, enabling it in Defender, key rotation, and checking headers.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-dkim-for-a-custom-domain-in-microsoft-365

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 8
01

Is DKIM enabled by default in Microsoft 365?

Only for the initial onmicrosoft.com domain. Every custom domain you add needs two CNAME records published in your DNS and DKIM explicitly enabled in the Defender portal. Until then, mail from that domain is signed with…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-dkim-for-a-custom-domain-in-microsoft-365

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 8
02

Why does the Defender portal say it can't enable DKIM?

The two CNAME records are missing, wrong, or not yet propagated. The error names which selector failed. Check with nslookup -type=CNAME selector1._domainkey.yourdomain.com — it must return the exact target from the port…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-dkim-for-a-custom-domain-in-microsoft-365

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 8
03

Does DKIM in Microsoft 365 cover mail sent by third-party services from my domain?

No. Microsoft 365 signs only what leaves Exchange Online. A marketing platform, ticketing tool, or payroll provider sending as your domain needs its own DKIM selector published in your DNS and configured in that service…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-dkim-for-a-custom-domain-in-microsoft-365

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 8
04

Step 1: Get the CNAME targets

In the Defender portal's DKIM page, select the domain and click Create DKIM keys if no keys exist. The portal shows two records. They follow a fixed pattern, so you can also derive them:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-dkim-for-a-custom-domain-in-microsoft-365

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 8
05

Step 2: Publish the CNAME records

In your DNS provider, add two CNAME records with the host names and targets above. TTL 3600 is fine. Do not add TXT records — Microsoft holds the actual keys behind the CNAME so it can rotate them for you.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-dkim-for-a-custom-domain-in-microsoft-365

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 8
06

Step 3: Enable signing

Back on the DKIM page, select the domain and switch Sign messages for this domain with DKIM signatures to Enabled. Or:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-dkim-for-a-custom-domain-in-microsoft-365

Slide 7Download PNG
M
solvingmicrosoft365.com
8 / 8
07

Step 4: Rotate keys (later, on a schedule)

Microsoft rotates keys automatically, alternating selectors; the CNAMEs never change. Use Rotate DKIM keys in the portal (or Rotate-DkimSigningConfig) after a suspected key compromise or when moving to 2048-bit keys, wh…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-set-up-dkim-for-a-custom-domain-in-microsoft-365

Slide 8Download PNG

Auto-generated from How to set up DKIM for a custom domain in Microsoft 365. This page is not indexed and isn't part of the guide itself.