How to Turn On DKIM in Microsoft 365

What you will need: Microsoft 365 admin access, login access to wherever your domain's DNS is managed (usually your domain registrar or web host), and about 30 minutes, plus waiting time for DNS to update.

What DKIM is and why it matters

DKIM (DomainKeys Identified Mail) is a digital signature added to every email you send. Receiving mail systems, like Gmail or Yahoo, use it to check that a message really came from your domain and wasn't altered along the way. The signature is checked against a public key you publish in your domain's DNS. DNS (Domain Name System) is the public address book that tells the internet where your website and email live.

Out of the box, Microsoft 365 signs your outgoing mail with its built-in "onmicrosoft.com" domain, not your own. That signature is valid, but it doesn't match your business domain. DMARC, the policy that tells receiving systems what to do with mail that fails authentication checks, looks for a signature from your own domain. So you need to turn on DKIM for your custom domain.

If mail from your business keeps landing in spam, DKIM is one of several things worth checking. Our guide Why Your Business Emails Land in Spam (and How to Fix It) covers the rest.

In this guide we use example.com as the sample domain. Wherever you see it, use your own domain.

Step 1: Check whether DKIM is already working

It's worth a quick check before changing anything. If you ran our Email Setup Check and saw "couldn't confirm" on the DKIM card, this test will tell you what is actually happening.

1. Send an email from your Microsoft 365 address to a personal Gmail address you can open. (Sending to a mailbox in the same Microsoft 365 account won't give you a reliable test.)
2. Open the message in Gmail.
3. Click the three dots in the top-right corner of the message, then click Show original.
4. Look at the summary at the top. Find the line that says DKIM.

If it says PASS with domain example.com (your own domain), DKIM is already set up for your domain and you can stop here. If it says PASS with a domain ending in onmicrosoft.com, or says FAIL or NEUTRAL, keep going.

Prefer Outlook? Open the received message and view its headers:

• Outlook on the web or the new Outlook: select the three dots on the message, then View, then View message details.
• Classic Outlook for Windows: open the message, then File, then Properties, and look in the Internet headers box.

Search the headers for "dkim=pass" and check that the domain next to it, shown as "header.d=", is your own.

Step 2: Find the DKIM settings in Microsoft Defender

1. Sign in to the Microsoft Defender portal at security.microsoft.com with your admin account.
2. In the left menu, click Email & collaboration.
3. Click Policies & rules.
4. Click Threat policies.
5. Click Email authentication settings.
6. Click the DKIM tab.

Shortcut: once you're signed in, security.microsoft.com/authentication takes you straight to Email authentication settings. Microsoft moves admin menus from time to time; if yours look different, use the portal's search box to look for "DKIM."

You'll see a list of your domains. Click your custom domain (example.com, not the one ending in onmicrosoft.com). A panel opens showing the DKIM status, which will likely be off.

Step 3: Add the two CNAME records at your DNS host

A CNAME record is a type of DNS entry that points one name to another. Microsoft uses two of them, one for each "selector." A selector is just a label that tells receiving systems which DKIM key to look up. Microsoft uses two so it can switch keys later without interrupting your mail.

The portal gives you two records, selector1 and selector2, each with a host name and a target value ("Points to"). If the panel doesn't show them yet, try switching signing on (Step 5). The portal will refuse with an error, and that error message contains the two values you need.

1. Keep the Defender panel open so you can copy values from it.
2. In another browser tab, log in to your DNS host and open the DNS settings for your domain. This may be labeled DNS, DNS Records, or Manage DNS.
3. Add a new record. Set the type to CNAME.
4. For the host name (sometimes called "Name" or "Host"), enter only selector1._domainkey.
5. For the value (sometimes called "Points to" or "Target"), copy and paste the selector1 target exactly as the portal shows it. Don't type it or build it by hand. Microsoft changed the format of these values in 2025, so older guides and screenshots may show something different. What your portal shows is the only version to trust.
6. Save the record.
7. Repeat for selector2: host name selector2._domainkey, with the selector2 target copied from the portal.

Watch for a doubled domain. Many DNS hosts automatically add your domain to the end of whatever you type. If you enter selector1._domainkey.example.com, the record can end up as selector1._domainkey.example.com.example.com, which won't work. That's why you enter only the short name. After saving, look at the record and make sure the domain isn't doubled.

Step 4: Wait for DNS to update

DNS changes don't take effect instantly. They need to spread across the internet, which is called propagation. Microsoft says this can take anywhere from a few minutes to 48 hours, depending on your DNS host.

It's fine to take a break here. Trying to enable signing too early is the most common reason for an error in the next step.

Step 5: Turn on signing for your domain

1. Go back to the Defender portal and return to the DKIM tab under Email authentication settings.
2. Click your domain (example.com).
3. Find the toggle labeled Sign messages for this domain with DKIM signatures and switch it to Enabled.
4. If the portal accepts it, you'll see the status change to show signing is on. If it shows an error, see the troubleshooting section below.

It can take a few minutes for the change to take effect on outgoing mail. If your first test doesn't show a change, wait a bit and try again.

Step 6: Check your work

Do both of these checks.

Check with the Email Setup Check:

1. Go to our Email Setup Check.
2. Enter your domain.
3. On the DKIM result card, choose I know my DKIM selector.
4. Enter selector1 and run the check. Then repeat with selector2.

Both should be found. The tool can't always work out your selector on its own, which is why it may have said it "couldn't confirm" DKIM earlier.

Check with a real email:

1. Repeat the Gmail test from Step 1: send a new message from your Microsoft 365 address to your Gmail address and click Show original.
2. Look for DKIM: PASS with domain example.com (your own domain).

Use a new message for this test. Messages sent before you enabled signing won't change.

Troubleshooting

An error when you try to enable signing, and the status shows "CnameMissing." This is the most common problem. It usually means one of two things:

• DNS hasn't finished updating. Wait longer, then try again.
• The host name or value is wrong. Open your DNS settings and compare the saved records with the portal. Look for a doubled domain name (...example.com.example.com), a missing _domainkey part, a typo in the value, or an extra space at the beginning or end of a pasted value.

DKIM is on, but only one domain works. DKIM is turned on per domain. If you send email from more than one domain, such as example.com and example.net, each one needs its own pair of CNAME records and its own toggle switched to Enabled.

The portal looks different from what we describe. Microsoft updates its admin menus often. If a menu name doesn't match, use the portal's search box to look for "DKIM" or "Email authentication settings."

Related security step

Once your outgoing mail is signed, it's a good time to protect the accounts that send it. Our guide How to Turn On Two-Factor Authentication for Microsoft 365 walks through that.

If you get stuck on any step, use the Get help with this button on your Email Setup Check results or send us a message through our contact form, and we'll help you work through it.