All guides · Updated: 2026-10-18

DKIM in Microsoft 365: sign your emails with your own domain

We checked 1,500 small-business sites (Shopify stores, Wix sites and apps on Vercel). On more than a third of those with email on Microsoft 365, DKIM had never been turned on. For your own domain, Microsoft 365 doesn't turn it on by itself: it has to be done once, in the Microsoft Defender portal.

Without DKIM on your domain, Microsoft 365 signs your emails as yourname.onmicrosoft.com. That signature never matches your domain, so your protection against fake email (DMARC) rests on SPF alone, which breaks when a message is forwarded.

Before you start

You need a Microsoft 365 admin account and access to wherever you manage the domain's DNS: where you bought the domain, Cloudflare, Wix…

Step 1: open DKIM in Microsoft Defender

Sign in to security.microsoft.com with the admin account.
Open Email & collaboration › Policies & rules › Threat policies › Email authentication settings and choose the DKIM tab.
On your domain's row, try to turn on the Toggle. A Client error appears with the record values: that's expected, because the records don't exist yet. Click OK.
Click your domain's row, outside the toggle. In the panel that opens, the Publish CNAMEs section shows the two records to create. Keep this panel open.

Step 2: create the two CNAME records in DNS

Wherever you manage DNS, create two CNAME records, with the values exactly as the portal shows them:

Type: CNAME
Name (host): selector1._domainkey
Value: selector1-yourcompany-com._domainkey.… (copy the value from the portal)

Type: CNAME
Name (host): selector2._domainkey
Value: selector2-yourcompany-com._domainkey.… (copy the value from the portal)

Don't copy the values from anywhere else, including this guide: since May 2025 new domains use one format (ending in dkim.mail.microsoft) and older ones another (ending in onmicrosoft.com), and only the portal knows which one is yours.

Cloudflare: DNS › Records › Add record, type CNAME. Leave the record as “DNS only” (grey cloud): with the proxy on, DKIM doesn't work.
Other providers: search their help for “add CNAME record”. In most, you type just selector1._domainkey as the name.

If your domain's DNS is on Wix: the Wix guide

Step 3: turn on signing

Wait a few minutes (sometimes longer) for Microsoft to find the records. Then, in the panel you left open, turn on Sign messages for this domain with DKIM signatures.

When it works, the domain's status becomes Signing DKIM signatures for this domain. If it stays on CnameMissing, Microsoft can't see the records yet: check the name and value of both, and try again later.

Step 4: check that it works

Send an email from your account to a Gmail account. Open it, click the three dots › Show original and look for the DKIM line: it should say PASS with your domain.

You can also check the domain here. If the warning “Microsoft 365 isn't signing your email with your domain” goes away, the records are published.

Mistakes we see often

Both CNAMEs created, but the “Sign messages…” toggle never turned on.
Values copied from another guide, in the wrong format for your domain.
Only one of the two records. You need both: Microsoft switches between them when it rotates the keys.
On Cloudflare, the CNAMEs with the orange cloud (proxy). They must be “DNS only”.
An old 1024-bit key. It works, but 2048 is recommended. The switch isn't done in the portal: it's done in Exchange Online PowerShell (Rotate-DkimSigningConfig -KeySize 2048). It isn't urgent.

What comes after DKIM?

With DKIM and SPF right, the next step is to make DMARC stop fake email: move from p=none to p=quarantine, without losing any email on the way.

From p=none to p=quarantine, step by step

So you don't have to check again

A change of email provider or a record deleted by mistake is enough to stop the signature working, and nobody notices. Excubitor can watch the domain every week and email you only when something changes. Free for 1 domain: run the check and press “Notify me”.