DKIM added

Question

I need DKIM added to my domain and check other DNS settings to improve functionality for my email service

Answer 1

Hi @Shari Waldschmidt,

According to your concern, if you are an administrator, you can follow the steps below to add DKIM to your custom domain and also check other DNS records. If you are an end-user, please contact your IT department since these actions require administrator privileges to be done. If you don't know who your IT administrator is, please refer to this article: How do I find my Microsoft 365 admin? - Microsoft Support 

• Navigate to Microsoft Defender portal and sign in with your admin account
• Go to Email & Collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM
• Select your domain and you will see two exact CNAME values you need to publish.
• Now open another browser tab or window and go to the domain registrar to create two CNAME records with the information from the above steps.
• Wait for a few minutes for Microsoft to detect your CNAMEs records then when back to Microsoft Defender and select "Enabled"

To double check your DNS records, please follow these steps:

• Sign in to Microsoft 365 Admin Center with your admin account
• From the left navigation bar, select Show all > Settings > Domains
• Select your domain > DNS records > Manage DNS > Continue
• In the Add DNS records page, check if you have selected the Exchange and Exchange Online Protection. In Advanced options, select DKIM
• Next step, expand and check your DNS records such as MX, TXT, SPF, DMARC records and also the CNAME Records under DKIM

I have provided the steps in simplified version for your convenience. If you have any trouble or misunderstanding in any step, please follow the detailed instructions in these articles:

• Configure DKIM in Microsoft 365 - Microsoft Defender for Office 365 | Microsoft Learn
• Connect your domain by adding DNS records - Microsoft 365 admin | Microsoft Learn

I hope this helps you move forward smoothly. If you have any questions or need further clarification, please feel free to leave a comment here and I’ll be happy to continue assisting you.

Thank you for your patience and understanding. Looking forward to hearing from you.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

To add DKIM and improve DNS settings for Microsoft 365 email, configure the required DNS records at the domain’s DNS host and then enable DKIM in Microsoft 365.

1. Add or verify core DNS records for Microsoft 365 email Make sure the following records exist at the DNS hosting provider for the domain used for email:
   • MX record (required)
     • Type: MX
     • Host/Name: @
     • Points to: the MX value shown in Microsoft 365 admin center (Domains → your domain → DNS records → Manage DNS → Add DNS records wizard)
     • Priority: highest (typically 0)
     • TTL: 3600
   • Autodiscover CNAME (recommended)
     • Type: CNAME
     • Host/Name: autodiscover
     • Points to: the autodiscover value shown in the same wizard
     • TTL: 3600
   • SPF TXT record (strongly recommended)
     • Type: TXT
     • Host/Name: @
     • Value: v=spf1 include:spf.protection.outlook.com -all
     • TTL: 3600
     • If an SPF record already exists, do not create a second one. Merge the Microsoft 365 value into the existing SPF so there is a single TXT SPF record.
2. Add DKIM CNAME records for the domain Use the Microsoft 365 admin center to obtain the exact DKIM CNAME values, then add them at the DNS host:
   • In Microsoft 365 admin center, go to Settings → Domains → select the domain → DNS records → Manage DNS → Add DNS records.
   • Under Advanced options, select DomainKeys Identified Mail (DKIM).
   • Two CNAME records are required:
     • CNAME 1
       • Host/Name: selector1._domainkey
       • Points to: first DKIM value shown in the wizard
       • TTL: 3600
     • CNAME 2
       • Host/Name: selector2._domainkey
       • Points to: second DKIM value shown in the wizard
       • TTL: 3600
   If the registrar supports Domain Connect, these DKIM CNAME records can be added automatically by choosing the Domain Connect option and authorizing the changes.
3. Enable DKIM signing in Microsoft 365 After the DKIM CNAME records are published and propagated:
   1. Go to the Defender portal: https://security.microsoft.com
   2. Navigate to Email & collaboration → Policies & rules → Threat policies → Email authentication settings, then open the DKIM tab (or go directly to https://security.microsoft.com/authentication).
   3. Select the custom domain or subdomain.
   4. If the domain shows Status = NoDKIMKeys and Toggle = Disabled, use the option to create DKIM keys, then enable DKIM for that domain.
   DKIM signing will start once Microsoft 365 detects the CNAME records in DNS.
4. Optional: Use subdomains for external services If third‑party email services are used (for example, a marketing platform), consider using a subdomain (such as marketing.contoso.com) and configuring DKIM there:
   • The provider supplies a public key or CNAME instructions.
   • Publish the DKIM key (TXT or CNAME) in DNS for that subdomain.
   • Ensure the DKIM d= domain matches the From: domain (for example, From: ******@marketing.contoso.com and d=marketing.contoso.com) so messages can pass DMARC alignment.
5. Verify DNS propagation and authentication
   • DNS propagation can take up to 24 hours depending on the DNS provider.
   • Use a DNS lookup tool (for example, What’s My DNS) to confirm:
     • TXT record for SPF is visible at the root of the domain.
     • CNAME records for selector1._domainkey and selector2._domainkey resolve to the Microsoft 365 DKIM endpoints.
   • After propagation, send a test email to an external mailbox and inspect headers to confirm DKIM=pass and SPF=pass.

These steps ensure DKIM is enabled and that MX, SPF, and related DNS records are correctly configured to improve deliverability and reduce spam/spoofing for Microsoft 365 email.

---

References:

• Connect your domain by adding DNS records
• Set up DKIM to sign mail from your cloud domain
• Best practices for email marketing
• Troubleshoot domain authentication errors