Dkim fails on customdomain.onmicrosoft.com

Question

Everything on both customdomain.microsoft.com and customdomain.xxx as far as dkim, spf, and dmarc is configured correctly. Both domains enabled and their DNS are checks OK.

customdomain.onmicrosoft.com (default signing domain)Authoritative
customdomain.xxx Authoritative

both customdomain.onmicrosoft.com and customdomain.xxx are enabled to sign.

While our custom domain passes the dkim test, the original, customdomain.onmicrosoft.com fails with reason, 
"signature verification"

Answer 1

Hi

 

Apologies for that, please try this one https://answers.microsoft.com/en-us/privatemessage/inbox

Thanks,

Momo

basically, I have used the following two sites for dkim test.

mx****: dkim lookup for customdomainid.onmicrosoft.com:selector1 returns No DKIM Record found

mx****: dkim lookup for customdomain.com:selector1 returns DKIM Record found

dmarcanalyzer.com/dkim/dkim-checker: for customdomain.com with selector1 returns "This seems to be a valid DKIM Record."

dmarcanalyzer.com/dkim/dkim-checker: for domainid.onmicrosoft.com with selector1 returns "We could not detect a DKIM record on this domain"

Answer 2

Please see attached.

Thank you.

Answer 3

Sorry Momo, the link, "Private Messages - Microsoft Community" lands me to a "message" page where no actionable buttons are present. How do I go about sending you pictures in pm?

Thank you.

Answer 4

Hi RefikO1

Thanks for the update!

Based on the screenshot, nothing seems amiss with your default domain.

To help me gain more insight on your issue, kindly confirm how you're running the dkim test?

In the mean time try to send an email using your default domain and share a screenshot of the header, to protect your privacy please share the screenshot in Private Messages - Microsoft Community

Regards,

Momo

Answer 5

Hi RefikO1

Thank you for posting in Microsoft community.

Generally  a customdomain.onmicrosoft.com domain is already set up by default, may you kindly try to verify if the original domain is enabled?

This can be done by an admin to verify please do the following:

#Go to Email & Collaboration > Policies & Rules > Threat policies page > Rules section > DKIM. Or, to go directly to the DKIM page, use https://security.microsoft.com/dkimv2.

#On the DKIM page, select the domain by clicking on the name.

#In the details flyout that appears, change the Sign messages for this domain with DKIM signatures setting to Enabled.

For further details on how to enable DKIM you may refer to How to use DKIM for email in your custom domain - Office 365 | Microsoft Docs

Please feel free to let us know how it goes.

Regards,

Momo.