How to check DKIM keys are published for each mail domain

What this check looks at

Checks each mail-receiving custom domain publishes DKIM keys: Microsoft 365 selector1 and selector2 where mail is delivered to Exchange Online, or a key on a common selector for other providers.

DKIM adds a cryptographic signature to each outgoing message, made with a private key held by the sending service; receivers check it against a public key published in DNS under a selector, such as selector1._domainkey.contoso.com. For custom domains Exchange Online uses two selectors, selector1 and selector2, published as CNAME records that point to keys Microsoft hosts and rotates. Until they are published and signing is on, Microsoft 365 signs with the tenant’s onmicrosoft.com domain, which does not align with the From address and does nothing for DMARC.

The check reads public DNS for every custom domain that receives mail; domains with no MX record are skipped. Where the domain’s mail goes through Microsoft 365, it fails when neither selector1 nor selector2 is published and warns when only one is, because Microsoft needs both to rotate keys. Where the domain uses another mail provider, it passes when a key is found on a common selector and warns when none is, as other providers’ selector names cannot be listed from DNS.

Without DKIM, DMARC rests on SPF alone, and SPF breaks whenever mail is forwarded (a customer’s auto-forward, a mailing list, a filtering service). Genuine messages then fail DMARC and are junked or refused once the policy is enforcing, which is often why organisations stay at p=none and leave their domain open to spoofing.

Why it matters

DKIM signs outgoing mail so recipients can prove it was not altered or forged. Without it, DMARC depends on SPF alone, which breaks whenever mail is forwarded — and mail from the organisation is more likely to be junked.

For a small firm the visible cost is deliverability: quotes, invoices and replies landing in customers’ junk folders, or refused by providers that now require authentication. Google and Yahoo require SPF or DKIM from every sender and both from bulk senders, and Microsoft applies similar rules to Outlook.com mailboxes.

The security cost is that the domain cannot safely move to an enforcing DMARC policy, so criminals can keep sending invoice fraud and phishing that appears to come from it. DKIM is what lets DMARC survive forwarding, and so what makes p=reject safe to publish.

The CIS Microsoft 365 Foundations Benchmark (2.1.9) and CISA SCuBA (MS.EXO.3.1) both ask for DKIM on every domain, CIS Controls v8 9.5 asks for DMARC, which depends on it, and NIST CSF 2.0 PR.DS-02 covers protecting data in transit. The NCSC’s email security guidance recommends DKIM alongside SPF and DMARC.

How to fix it

Where: Microsoft Defender portal → Email authentication settings → DKIM

Before you start

• Publish the two CNAME records Microsoft gives you in Defender, DKIM, for each domain, before turning signing on.

Step by step

1. 1Check which domains need keys. Open the finding’s evidence: each domain shows whether no selector, only one selector, or another provider’s key was found. Check a domain yourself with Resolve-DnsName -Name selector1._domainkey.contoso.com -Type CNAME, and the same for selector2.
2. 2Get the two CNAME records from Microsoft Defender. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings and select the DKIM tab. Select the domain; if the flyout says there are no DKIM keys for it, select Create DKIM keys. Copy the two CNAME records it shows, for the host names selector1._domainkey and selector2._domainkey.
3. 3Publish both CNAMEs at the DNS host. Add both CNAME records at the domain’s DNS host exactly as shown. Many DNS hosts append the domain to the host name automatically, so enter selector1._domainkey rather than selector1._domainkey.contoso.com where that applies. Publishing only one leaves the check at a warning and breaks key rotation.
4. 4Turn signing on. Once both records resolve (usually within minutes, at most the record’s TTL), return to the domain on the DKIM tab and set Sign messages for this domain with DKIM signatures to Enabled. The status should change to Valid; if it still reports the CNAMEs missing, wait for DNS and try again.
5. 5Or do it in Exchange Online PowerShell. Run New-DkimSigningConfig -DomainName contoso.com -Enabled $false if the domain has no configuration yet, then Get-DkimSigningConfig -Identity contoso.com | Format-List Selector1CNAME, Selector2CNAME for the values to publish. After publishing them, run Set-DkimSigningConfig -Identity contoso.com -Enabled $true.
6. 6Set up DKIM with the other senders. For a domain whose mail is sent by another provider (Google Workspace, a hosting company), turn on DKIM in that provider’s admin console and publish its key. For third-party services that send as the domain alongside Microsoft 365, set up their custom-domain DKIM too, so their mail aligns for DMARC.
7. 7Confirm with a real message. Send a message from each domain to an external mailbox, open the headers and check for a DKIM-Signature with d= set to your domain and an Authentication-Results line showing dkim=pass for it. The next assessment passes once both selectors are published for each Microsoft 365 domain.

What users will notice

None. Outgoing mail is signed, which helps it reach the inbox.

How to confirm it worked

Send an email to an external mailbox and check the message headers show dkim=pass for the domain.

Frameworks and controls

This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Set up DKIM to sign mail from your domain (Microsoft Learn)

Related checks

• How to turn on DKIM signing in Microsoft 365
• The SPF record for Microsoft 365, and how to check it
• How to block automatic email forwarding in Microsoft 365
• How to find mail flow rules that skip spam filtering

The full Microsoft 365 security checklist, worst first