DKIM CNAME records

Peter Dispaine 0 Reputation points
2026-11-08T20:31:17.6+00:00

I'm using a 3rd party for my Domain.

I've added the required DKIM CNAME records to DNS settings.

They've been accepted by the 3rd party. How can I check its worked with Microsoft?

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ivory 2,615 Reputation points Independent Advisor
    2026-11-08T20:40:03.31+00:00

    Hi Peter,

    If you have already added the required DKIM CNAME records with your third-party DNS provider and they have confirmed the records are in place, the next step is to verify that Microsoft can detect them.

    You can do this by going to Microsoft 365 Defender > Email & Collaboration > Policies & Rules > Threat Policies > DKIM, then selecting your domain. If Microsoft recognizes the CNAME records, you should be able to enable DKIM or see that it is already enabled.

    You can also use Exchange Online PowerShell by running:

    Get-DkimSigningConfig -Identity yourdomain.com | Format-List

    Look for:

    Enabled : True

    Status : Valid

    A status of Valid indicates Microsoft can locate the required DKIM records.

    For more information, please consult How to use DKIM for email in your custom domain - Microsoft Defender for Office 365 | Microsoft Lea…

    You may also verify the DNS records using a public DNS lookup tool such as MXToolbox or DNSChecker to confirm that the records are publicly resolving. Please note that DNS propagation can take up to 48 hours, depending on your DNS provider's settings.

    If Microsoft still does not recognize the records, verify:

    • The CNAME hostnames exactly match the values provided by Microsoft.
    • There are no extra characters, spaces, or duplicated domain names.
    • The records are CNAME records, not TXT records.
    • The domain status in Microsoft 365 is Healthy/Verified.

    You can also run Microsoft’s DKIM diagnostic: Diagnostics tab in the Microsoft 365 Admin Center Enhanced engagements section - Microsoft 365 Ente…

    If you have any questions or need further assistance, please feel free to share them in the comments on this post.

    If the answer is helpful, please click 'Yes' and kindly upvote it.

    Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-08T20:31:57.7533333+00:00

    Publishing the CNAME records is only the DNS step; enable DKIM for the domain in Microsoft 365, confirm its status is Valid, and then verify a sent message reports dkim=pass.

    1. Confirm and enable DKIM in Microsoft 365

    Sign in with a Microsoft 365 administrator account, then:

    1. Open the Microsoft Defender portal.
    2. Go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings.
    3. Select the DKIM tab.
    4. Select your custom domain.
    5. Check its state:
      • Status: Valid and Toggle: Enabled — Microsoft 365 has detected the CNAME records and DKIM signing is enabled.
      • Status: Valid, but Disabled — change the toggle to Enabled.
      • Status: CnameMissing — Microsoft 365 cannot yet resolve one or both records. Compare the displayed Publish CNAMEs values with those at your DNS provider and allow more time for DNS propagation.

    Microsoft specifically advises obtaining the required CNAME targets from the Defender portal or Exchange Online PowerShell; example values from documentation should not be copied because newer domains can use a dynamically assigned CNAME format.^1^

    2. Run Microsoft’s DKIM diagnostic

    For an additional tenant-side check:

    1. Open the Microsoft 365 Admin Center.
    2. Go to Diagnostics.
    3. Select Validate DKIM Signing Configuration.
    4. Select your custom domain and run the test.

    A successful result is Properly Created and Correct DNS Entries Enabled. The diagnostic can also distinguish between incorrect DNS publication, a configuration that exists but is not enabled, and a missing DKIM configuration.^2^

    3. Verify an actual signed message

    This is the end-to-end test:

    1. Send a new message from an address using the custom domain through Microsoft 365.
    2. Send it to a mailbox where the full internet headers can be viewed.
    3. Open the received message’s headers.
    4. Find Authentication-Results and look for:
    dkim=pass (signature was verified) header.d=example.com

    Also find the DKIM-Signature header and confirm that:

    • d= identifies the expected signing domain.
    • s= identifies one of the configured Microsoft selectors.

    Microsoft records dkim=pass, dkim=fail, or dkim=none in the Authentication-Results header. pass confirms that the recipient resolved the public key and successfully verified the signature.^3^

    If the portal shows Enabled/Valid but the message reports:

    • dkim=none: the message was not DKIM-signed. Confirm it was sent through Microsoft 365 using the configured domain.
    • dkim=fail: check the accompanying reason. A missing/wrong selector can indicate a DNS mismatch; a body-hash failure can indicate that another service modified the message after signing.^4^
    • dkim=pass with an unexpected header.d domain: another service may be signing the message. For DMARC alignment, the DKIM signing domain should align with the visible From-address domain.

    Optional PowerShell confirmation

    In Exchange Online PowerShell, run:

    Get-DkimSigningConfig -Identity example.com |
    Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME

    Replace example.com with your domain. The expected Microsoft 365 state is:

    Enabled : True
Status  : Valid

    The selector values should match the CNAME targets published by the DNS provider.^1^

    References

    1. Set up DKIM to sign mail from your cloud domain
    2. Diagnostics in Enhanced Engagements
    3. Anti-spam message headers in cloud organizations
    4. Troubleshoot email authentication in Microsoft 365
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.