The short answer

Add two CNAME records, selector1._domainkey and selector2._domainkey, using the values Microsoft shows for your domain. Then switch on DKIM signing for that domain in the Microsoft Defender portal.

Until you do, Microsoft signs your mail with its own onmicrosoft.com domain. That signature does not match your “from” address, so it does not help you pass DMARC.

Why Microsoft uses two records

DKIM works with a pair of keys. Microsoft keeps the private key and signs every message. Your DNS points to the public key, so receivers can check the signature.

The two CNAME records point to two keys that Microsoft manages. It switches between them when it rotates keys, so you never need to update your DNS. This is also why you should use CNAME records exactly as shown, not copy the keys into TXT records.

Before you start

  • An admin account. You need a Microsoft 365 role that can manage email security, such as Security Administrator or Global Administrator.
  • Access to your DNS. Know where your domain’s DNS is managed and have the login ready.
  • Your domains. Make a list of every custom domain in Microsoft 365 that sends email.
  • A quiet moment. Adding DKIM does not interrupt email, but it is easier to test when you are not rushing.

DKIM can be set up without changing your MX or SPF records, so mail keeps flowing throughout.

Step 1: find your values

Sign in to the Microsoft Defender portal with an admin account. Go to the email authentication settings, open the DKIM tab and select your domain. Microsoft shows the two CNAME records to publish.

Microsoft renames menus from time to time. If the screen differs, look for “Email authentication settings” under the threat policies, or search Microsoft’s documentation for the current path. Admins comfortable with PowerShell can also get the values with Exchange Online PowerShell.

Each record has a host name, such as selector1._domainkey, and a target value ending in a Microsoft domain. Copy both values exactly. The targets differ for every domain.

Step 2: add the CNAME records

Sign in to wherever your domain’s DNS is managed. That might be your domain registrar, your website host or a service such as Cloudflare. Create two CNAME records:

  • Host selector1._domainkey, pointing to the first value Microsoft gave you.
  • Host selector2._domainkey, pointing to the second value.

Many DNS hosts add your domain to the end of the host name for you. If you type the full name, you may end up with your domain twice. If you use Cloudflare, set these records to “DNS only”, not proxied.

Step 3: wait for DNS

New records often work within minutes, but they can take up to a day or two to be seen everywhere. You can check them with an online DNS lookup tool before moving on.

Step 4: enable DKIM signing

Go back to the DKIM tab in the Defender portal, select your domain and turn on signing. If the records are found, the status changes to show your domain is signing.

If you see an error saying the CNAME records are missing, Microsoft cannot see them yet. Wait a little longer, check for typos, then try again.

Step 5: test it

  1. Send an email from your Microsoft 365 mailbox to a Gmail address.
  2. Open it in Gmail, open the menu and choose “Show original”.
  3. Check DKIM shows PASS with your domain, not onmicrosoft.com.
  4. In the full headers, look for dkim=pass with header.d=yourdomain.co.uk.

You can also run our free email check to confirm your domain’s DKIM, SPF and DMARC records.

Common problems

  • The domain name appears twice in the host name, because the DNS host added it automatically.
  • A typo in the target value, often a missing or extra character near the end.
  • Records added but signing never switched on. The records alone do nothing.
  • Extra domains forgotten. Every custom domain that sends mail needs its own pair of records and its own switch.
  • Proxying turned on in Cloudflare, which stops the records being read correctly.

After DKIM, add DMARC

DKIM on its own does not tell receivers what to do with fake mail in your name. That is DMARC’s job. Read what DMARC is and how to set it up, and why business emails go to spam for the wider picture. If you would rather we set it up, see DMARC setup and fixing emails that go to spam.