Last updated: July 2026

In short: After this guide Microsoft 365 signs your outgoing email with DKIM — via two CNAME selectors pointing to Microsoft-managed keys.

Prerequisites

  • A Microsoft 365 tenant with a custom domain
  • Access to the Microsoft Defender portal (a role for email authentication)
  • Access to your domain’s DNS management (at the domain host)

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing email, which the recipient checks via a public key published in DNS. Microsoft 365 stores these keys as CNAME entries — other email systems often use TXT entries instead.

For context: while SPF authorizes the server, DKIM secures the message. Only with DMARC does it become an enforceable foundation.

The starting point at Microsoft 365

Two things up front:

The *.onmicrosoft.com domain is signed automatically — for mail that only runs through it, you don’t have to do anything. For your custom domain (example.com) you activate DKIM once in the Defender portal and create two CNAME entries at the domain host.

Microsoft generates two key pairs and provides the selectors selector1._domainkey and selector2._domainkey — the hostnames are identical for all Microsoft 365 organizations. The private keys stay at Microsoft; the CNAMEs point to the public ones.

Note, format change: since May 2025 Microsoft uses a new CNAME target format for new domains, with a dynamically assigned partition character. So you should always fetch the exact target values from your own tenant and not copy them from an older guide.

Step-by-step guide

1. Open DKIM in the Defender portal

Go to security.microsoft.com/authentication and select the DKIM tab. Click your custom domain — the detail flyout shows the two CNAME values to create.

2. Fetch the exact CNAME target values

The hostnames are fixed:

  • selector1._domainkey
  • selector2._domainkey

The target values depend on your tenant. For new domains (since May 2025) they have the form:

selector1-<CustomDomainWithDashes>._domainkey.<InitialDomainPrefix>.<DynamicPartitionCharacter>-v1.dkim.mail.microsoft

For existing domains the old format still applies:

selector1-contoso-com._domainkey.contoso.onmicrosoft.com

The dynamic partition character is assigned by Microsoft and is not configurable. Instead of guessing, fetch the exact values via PowerShell:

Get-DkimSigningConfig -Identity contoso.com | Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME

(replace contoso.com with your domain). The two SelectorXCNAME values are the targets of your CNAME entries.

3. Create the CNAME entries at the domain host

At your domain’s DNS provider, create two CNAME records: selector1._domainkey and selector2._domainkey, each with the matching target value from step 2. Where exactly is shown in our host guides — e.g. IONOS, Strato, or Netcup.

Important with Cloudflare: disable the Cloudflare proxy (the orange cloud) for the DKIM CNAME entries — proxied CNAMEs don’t resolve correctly and Microsoft’s validation fails.

4. Activate DKIM

Back in the Defender portal: on the DKIM tab, slide your domain’s toggle from Disabled to Enabled. If the status doesn’t change immediately, choose Refresh — then the value jumps to Enabled.

5. Wait until the change is live

DNS propagation can take a few minutes to 48 hours depending on the provider and TTL. If the status stays on CnameMissing longer, check the entries (and the Cloudflare proxy).

Verify the result

Check your configuration with the free MXAudit scanner — it shows you DKIM, SPF, and DMARC at a glance.

Common mistakes

Copied old CNAME values from a guide. Since May 2025 the format is different and tenant-specific. Always fetch your own values from the portal or via Get-DkimSigningConfig — the old and new format must not exist simultaneously for the same selector.

Left the Cloudflare proxy on. Proxied (orange) DKIM CNAMEs don’t resolve; the status stays CnameMissing. Set the proxy to “DNS only” (grey cloud).

Created only one selector. Microsoft 365 needs both (selector1 and selector2._domainkey).

Flipped the toggle before the CNAMEs propagated. First create the CNAMEs and let them resolve, then flip the switch — otherwise activation fails.

Further reading