DKIM

DomainKeys Identified Mail (DKIM) is a DNS-based mechanism that lets a receiving mail server cryptographically verify that a message really came from your domain and wasn't tampered with in transit. The sending mail server signs outgoing messages with a private key; receivers fetch the matching public key from a DNS record at selector._domainkey.yourdomain.com and verify the signature. In Microsoft 365, DKIM is enabled per-domain in the Defender portal, with two selectors (selector1 and selector2) for key rotation. Microsoft auto-rotates the keys. Combined with SPF and DMARC, DKIM is essential for email deliverability and anti-spoofing.

Worked example

A company migrates its marketing newsletter platform to a new third-party sender. Emails start landing in recipients' spam folders because the new platform signs outgoing mail with its own DKIM key, tied to its own selector, and the receiving mail servers have no way to associate that signature with the company's domain reputation. The fix is adding the marketing platform's provided CNAME records for its DKIM selector to the company's DNS, so mail it sends on the company's behalf is signed in a way receiving servers can verify against records the company itself published.

Common pitfalls

Enabling DKIM in the Defender portal but never verifying the DNS CNAME records actually resolve is a common half-finished setup — Microsoft's DKIM signing only takes effect once those records are correctly published, and a typo or missing record leaves mail unsigned with no visible error until deliverability quietly degrades. Assuming DKIM alone stops spoofing overstates what it does — DKIM proves a message wasn't altered in transit and came from a domain that authorised the signing key, but without DMARC telling receivers what to do when SPF or DKIM fail, a spoofed message with no valid signature at all can still be accepted. And forgetting that every third-party service sending mail "as" the company's domain (a CRM, a helpdesk tool, a marketing platform) needs its own DKIM configuration is a frequent gap — each one needs to be individually set up, not covered by Microsoft's default DKIM for the primary domain.