Configure DKIM Signature for a Domain in Microsoft 365 (Exchange Online)

2.5K

DKIM (DomainKeys Identified Mail) is an email authentication method used to verify the sender’s identity and ensure that the message has not been altered in transit. DKIM, along with SPF and DMARC, can help prevent attackers from spoofing emails sent from your domain.

DKIM uses public key cryptography. In Microsoft 365, you can publish CNAME records in their DNS zone that point to Microsoft-hosted DKIM public keys. DKIM is based on a pair of private and public keys and an asymmetric encryption algorithm (RSA). The public key is stored as a TXT entry in the DNS, and the private key is used to sign outgoing email messages.

This guide explains how to configure DKIM signing for a custom domain in Microsoft 365 (Exchange Online, EOL).

Add DKIM signature for every outgoing email from domain

In Microsoft 365 DKIM is enabled by default for the *.onmicrosoft.com domains, so you can only enable it for custom domains.

1. Sign in to Microsoft 365 Defender (ex. Microsoft 365 Security center).
2. Navigate to Email & collaboration > Policies & rules > Threat Policies > Email authentication settings > DKIM.
3. Select a domain from the list for which you want to enable DKIM.

   

4. By default, there are no DKIM keys for the domain. Click Create DKIM Keys.

   

5. Microsoft will generate two CNAME records that you need to copy and add to your domain’s DNS zone at the registrar. These DKIM keys have the following format:
   

   Name: selector1._domainkey 
   
   Value: selector1-theitbros-com._domainkey.theitbros.onmicrosoft.com 
   
   Name: selector2._domainkey 
   
   Value: selector2-theitbros-com._domainkey.theitbros.onmicrosoft.com 

   
   

   

6. Login to your DNS hosting provider and create the required CNAME records. Create two new CNAME records (record type: CNAME) in your DNS zone with the DKIM values that you copied from the Microsoft 365 Security Center.
   

   

7. After adding these DNS records, wait some time to updates apply to zone (from 15 minutes to 24 hours). You must not enable DKIM until Microsoft successfully validates both CNAME records.
8. Go back to the DKIM setting for a domain and enable the Sign messages for this domain with DKIM signatures option.

Now Microsoft 365 will add a special DKIM signature to header of every outgoing email from your domain. You can view it in any email client.

Check if DKIM keys for domain are published correctly

You can test whether the DKIM keys for your domain are correctly published in the DNS by using the online service https://mxtoolbox.com/dkim.aspx.

Enter your domain name, selector1 and click DKIM lookup.

You can also verify that the required CNAME records are published by using the built-in Windows DNS tools:

Resolve-DnsName selector1._domainkey.theitbros.com -Type CNAME
Resolve-DnsName selector2._domainkey.theitbros.com -Type CNAME

Alternatively, you can use the legacy nslookup utility:

nslookup -type=CNAME selector1._domainkey.theitbros.com
nslookup -type=CNAME selector2._domainkey.theitbros.com

Both commands should return the Microsoft 365 CNAME targets that were generated for your domain.

If the checks are successful, information about the domain’s TXT record with the DKIM parameters will be displayed. The p field contains the DKIM public key, which is used by recipients to verify the DKIM signature in emails from senders of your domain.

Note. Microsoft recommends periodically rotating DKIM keys as part of your organization’s security policy. This improves security. To do this, click the Rotate DKIM keys button at the bottom of the form.

Enable and manage DKIM in Microsoft 365 using PowerShell 

You can also use PowerShell to enable and manage DKIM in Microsoft 365.

Connect to your Exchange Online tenant:

Connect-ExchangeOnline

List DKIM selectors for your custom domain:

Get-DkimSigningConfig -Identity theitbros.com | fl Selector1CNAME,Selector2CNAME

Enable DKIM for a domain:

Set-DkimSigningConfig -Identity theitbros.com -Enabled $true

Then you need to verify the current DKIM config:

Get-DkimSigningConfig -Identity theitbros.com |
Select-Object Domain, Enabled, Status

Tip. If the DKIM status does not immediately change after enabling it, you should verify that the required CNAME records have propagated successfully in public DNS and wait for Microsoft 365 to detect them.

Check which domains in EOL have DKIM enabled:

Get-DkimSigningConfig

Note. The on-premises versions of Microsoft Exchange Server 2019 and 2016 do not natively support DKIM. To implement this, you can use the free Exchange DKIM Signer transport agent, available on GitHub (https://github.com/Pro/dkim-exchange). This solution is intended for on-premises Exchange Server only and is not required for Exchange Online.

Verify DKIM Signing

1. Send a test email to Gmail or Outlook.com.
2. Open the message headers.
3. Verify that a DKIM-Signature header is present and that authentication results show dkim=pass.