- Home
- Guides
- Microsoft 365 Setup
- How to enable DKIM for Microsoft 365 and protect your email reputation
How to enable DKIM for Microsoft 365 and protect your email reputation
Turn on DKIM signing for your custom domain in Microsoft 365 so receiving servers can verify your emails really came from you. It takes two CNAME records and one toggle.
By Nur Islam- 3:36 video
- 5 steps
- 1.8K views
Jump to a step (5)
Without DKIM, receiving mail servers have less proof that email from your domain is genuine. That makes your messages more likely to land in spam and makes it easier for someone to impersonate your business address.
DKIM (DomainKeys Identified Mail) adds an invisible digital signature to every email you send, a bit like a watermark on a document. Mail servers and spam filters check it to confirm the email came from your domain and was not changed on the way.
In Microsoft 365 you enable it in the Defender security portal. Microsoft gives you two CNAME records, you add them at your DNS host (GoDaddy in the video), and once they are live you switch DKIM on.
What you need
- Microsoft 365 admin access
- A custom domain added to Microsoft 365
- Access to the domain's DNS settings (registrar or web host)
Step by step
0 of 5 done-
01
Open the DKIM settings
Sign in to the Microsoft 365 admin center. Select
Show all, then underAdmin centerschooseSecurity. In the security portal go toEmail & collaboration>Policies & rules>Threat policies, scroll down toEmail authentication settingsand open theDKIMtab. -
02
Select your domain and get the CNAME records
Select the domain. It shows DKIM as disabled. Select the toggle to enable it. If the CNAME records are not in your DNS yet you get an error, and the panel shows the two records you need: host names like
selector1._domainkeyandselector2._domainkey, each with its own value. -
03
Add the two CNAME records to your DNS
In your DNS host (the video uses GoDaddy), open the domain's DNS settings and add a new record:
Type:CNAMEName: the first host name,selector1._domainkeyValue: the first value copied from Microsoft 365
Add a second CNAME record with the
selector2._domainkeyhost name and its value. Save all records. -
04
Wait, then enable DKIM
DNS changes can take anywhere from a few minutes to 48 hours to spread. If enabling still fails, wait and try again. Once Microsoft finds the records, the toggle turns DKIM on. It may take a few minutes for the status to update. From then on, outgoing email from the domain is signed.
-
05
Rotate the DKIM keys from time to time
Microsoft recommends changing the DKIM key periodically, for the same reason you change passwords. Use the
Rotate DKIM keysoption on the same page. You do not need to change the CNAME records when you rotate.
Tips and common problems
- The first attempt to enable DKIM usually fails with an error. That just means the CNAME records are not published yet.
- Copy the host names and values exactly from Microsoft 365. One wrong character and verification never succeeds.
- Some DNS hosts add your domain to the host name automatically, so you only enter the selector1._domainkey part.
- Rotating DKIM keys later does not need any DNS changes.
Questions
Where do I enable DKIM in Microsoft 365?
In the Microsoft Defender portal: Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM. Select your domain and turn it on.
Why does Microsoft 365 say CNAME record does not exist when I enable DKIM?
The two selector CNAME records are not in your DNS yet or have not propagated. Add both records at your DNS host, wait (up to 48 hours in some cases) and try again.
Do I need to update DNS when I rotate DKIM keys?
No. After the two CNAME records are in place, rotating keys in Microsoft 365 needs no DNS changes.
