Trouble syncing the dkim

Question

Hello!

I've recently purchased a domain name and I'm in the process of updating my DNS. I added two CNAME records for selector1._domainkey and selector2._domainkey according to the instructions I've seen online. Originally I had them pointing to data with onmicrosoft.com but when I went into the MS defender several days later (to give it ample time to sync) it gave me this message:

|Microsoft.Exchange.Management.Tasks.ValidationException|CNAME record does not exist for this config. Please publish the following two CNAME records first. Domain Name : replacewithmydomain Host Name : selector1._domainkey Points to address or value: selector1-replacewithmydomain-com._domainkey.NETORGFT19181271.r-v1.dkim.mail.microsoft Host Name : selector2._domainkey Points to address or value: selector2-replacewithmydomain-com._domainkey.NETORGFT19181271.r-v1.dkim.mail.microsoft . If you have already published the CNAME records, sync will take a few minutes to as many as 4 days based on your specific DNS. Return and retry this step later.

So according to this, the data was incorrect and now both records are pointing to

1. selector1-replacewithmydomain-com._domainkey.netorgft19181271.r-v1.dkim.mail.microsoft.com.
2. selector2-replacewithmydomain-com._domainkey.netorgft19181271.r-v1.dkim.mail.microsoft.com.

I've waited 4 days, and the defender is still telling me in the status: CnameMissing for my domain.

I've tested the records in MXtoolbox and everything is found and working.

Please, how do I get this to sync up??

Thank you.

Answer 1

Hello SJS,

Thanks for your post in Microsoft Q&A.

That is a very common and incredibly frustrating DKIM issue, so I completely get your confusion. Honestly, the fact that you've already used MXToolbox to verify the records tells me you've done everything right on your end. This almost always means the problem isn't with your DNS provider, but that Microsoft's validation check is simply "stuck".

It likely cached the old, incorrect result and is refusing to look again.

Before we get to the fix, let's do one quick 30-second sanity check, because those long CNAME values can be tricky:

In your DNS settings, just double-check that the Host Name is exactly selector1._domainkey (and not selector1._domainkey.`yourdomain.com`).

Then, give the Points to value one last look to make sure it's a character-for-character match with what Defender is asking for.

If you're confident that all looks good, then it's time to give the system a nudge to force it to re-validate. The go-to solution for this is to quickly toggle DKIM off and on again for that domain. The cleanest way is with a few PowerShell commands.

You'll need to connect to Exchange Online. If you don't already have the module, this first command will grab it for you: Install-Module -Name ExchangeOnlineManagement

Then, connect to your account (you'll get a sign-in prompt). Make sure you're using an account with admin rights: Connect-ExchangeOnline

Now, run this command to disable DKIM for your specific domain (just replace `yourdomain.com`):

Set-DkimSigningConfig -Identity `yourdomain.com` -Enabled $false

Give it about five minutes to process, then run this last command to turn it back on:

Set-DkimSigningConfig -Identity `yourdomain.com` -Enabled $true

That final step is what forces Microsoft's servers to perform a completely fresh lookup of your DNS records. I'd give it about an hour after that, and your "CnameMissing" error will be gone when you check the Defender portal again.

Hope this helps. Let me know how it goes!

Best regards,

Alex | Microsoft Q&A Support Specialist

 

Answer 2

I finally got this working after deleting the ".com" top level domain after "microsoft".

The text that worked is literally:

CNAME Record
selector1._domainkey
selector1-xxxxxx-com._domainkey.xxxxxx.k-v1.dkim.mail.microsoft

This TLD is explained here:
https://techcommunity.microsoft.com/blog/microsoft_365blog/introducing-cloud-microsoft-a-unified-domain-for-microsoft-365-apps-and-services/3804961