Office 365 DKIM Setup: Enable, Verify, and Configure

Blog

Secure your emails with this Office 365 DKIM setup guide. Learn how to configure, verify, and manage DKIM for custom domains.

by Yunes Tarada

Last Updated:
Reading Time: 7 min
Office 365 DKIM Setup: Enable, Verify, and Configure
Table Of Contents−

Key Takeaways

  1. Enabling DKIM for Office 365 improves email security and deliverability.
  2. Multiple domains require manual DKIM configuration in the Microsoft 365 Defender portal.
  3. Publishing DKIM records involves creating CNAME records in your DNS management console.
  4. Validating your DKIM records is essential for ensuring proper email authentication.
  5. DKIM helps protect your domain from spoofing, phishing, and improves compliance with industry regulations.

DKIM for Office 365 is a specific implementation of the DKIM (DomainKeys Identified Mail) email authentication protocol that can be used to verify the legitimacy of the sender’s domain and ensure that the email content has not been altered during transit. If you enable DKIM, it can significantly help improve your email security and email deliverability. 

Moreover, when combined with DMARC, the DKIM email authentication method improves the chances of your legitimate emails reaching the recipient’s inbox instead of being flagged or rejected by email spam filters.

Let’s learn more about the DKIM for Office 365 setup to improve your domain’s security and email deliverability!

Prerequisites of Office 365 DKIM Setup

Before setting up DKIM for Office 365, make sure you have the following in place:

  • Access to the Microsoft 365 admin center with the necessary administrative permissions.
  • Ability to update DNS records for your custom domain through your DNS hosting provider.
  • A verified custom domain has been added to your Office 365 tenant.

Note: DKIM for Office 365 is now configured through the Microsoft 365 Defender portal, instead of the old Exchange Online portal, due to security updates by Microsoft.

How to Set up DKIM for Office 365 for Custom Domains

If you use Office 365 as your email service provider, keep these key points in mind:

  • If you use the default onmicrosoft.com domain to send emails, you don’t need to set up DKIM manually.
  • For a single custom email domain, Microsoft automatically enables DKIM with 2048-bit keys by default.
  • Manual DKIM setup is only needed if you have multiple custom domains registered in Office 365.

Follow the steps below to set up DKIM for Office 365 custom domains:

1. Log into Microsoft Defender Portal

  • Login to your Defender account admin center. You can use the link provided here.
  • On the portal, navigate and click on Policies & Rules under Email & Collaboration
  • On the Policies & Rules page, select Threat Policies

Log into Defender Portal

2. Generate DKIM DNS records

  • Select DomainKeys Identified Mail (DKIM) to open the DKIM tab
  • On the DKIM page, select the domain you want to enable DKIM for (this is the domain you use to send outbound messages)

  • You can now toggle the Enable button to start the activation process for DKIM. A dialogue box will appear which may contain the following status. Simply click on the Create DKIM keys button to view your keys:

Create your DKIM keys

You can also PowerDMARCS DKIM generator to create DKIM records.

3. Copy and add the CNAME records to DNS

A pop-up will display 2 CNAME-type DKIM records—these contain your DKIM public keys needed for email authentication. You will need to:

  • Click the blue “Copy” button to copy each CNAME record to your clipboard.
  • Add these CNAME records to your domain’s DNS settings through your domain registrar or hosting provider’s control panel:
  • Log in to your DNS management console.
  • Find the section to add new DNS records.
  • Choose CNAME as the record type.
  • Paste the copied values exactly as provided into the appropriate fields.
  • Save and apply your changes so the records become active and your DKIM setup works properly.

Copy the DKIM CNAME records

4. Enable DKIM in Defender

After your DNS CNAME records have propagated (this may take some time), return to the Microsoft Defender portal. Locate your custom domain in the DKIM settings and enable DKIM signing to activate email authentication for that domain.

Troubleshooting: DKIM Couldn’t Be Enabled?

If an error persists and DKIM can’t be enabled for your domain on Microsoft’s Defender portal, here are some common reasons:

  • DNS records may not have fully propagated yet—this can take up to 48 hours
  • There could be typos or syntax errors in your CNAME records, such as extra spaces or incorrect characters
  • The DKIM selector might be incorrect or doesn’t match what Microsoft expects

To resolve the issue:

  • Use a DKIM record lookup tool to check if your published records are valid and error-free
  • Confirm that the DNS changes have fully propagated by waiting or using online DNS propagation checkers
  • Double-check your CNAME record syntax and selector values for accuracy
  • Contact your DNS hosting provider if the problem persists
  • If needed, reach out to Microsoft Support for further assistance

How to Configure DKIM for Office 365 Using Powershell

For advanced users and administrators, Exchange Online PowerShell offers powerful tools to manage and configure email settings, including DKIM. Using PowerShell commands allows you to automate DKIM setup, enable or disable DKIM signing for your custom domains, and troubleshoot issues efficiently, especially useful when managing multiple domains or complex environments.

You can use Powershell to enable your Exchange Online DKIM setup for office 365, especially if you want to enable it for multiple domains. To do so:

1. Connect to Exchange online

Connect to Exchange online

2. Extract your Office 365 DKIM selectors by running the following script:

3. Add the CNAME records provided to your by Office 365 to your DNS

4. Run the following command to enable DKIM for the domain:

Setup DKIM for Office 365 the right way with PowerDMARC!

Start 15-day trial Book a demo

How to Publish Office 365 DKIM Records in Your DNS

  • Login to your DNS provider’s management console
  • Navigate to the DNS records section
  • Create new CNAME records (Record type: CNAME)
  • Paste the copied hostnames and values, as provided on the Defender portal
  • Keep TTL as 3600
  • Save changes to your record to finish setting up DKIM for Office 365. Wait for 24-48 hours to enable DKIM validation.

Note: The process for publishing DNS records varies depending on which DNS hosting provider you use. The time it takes for DNS propagation activate the records also depends on the same. The processes for a few of the major providers are linked below:

How to Disable DKIM for Office 365?

You can disable DKIM for Office 365 with a single click in the Defender portal. However, keep in mind that turning off DKIM may weaken your email security, especially in cases like email forwarding where SPF checks can fail. It’s generally best to keep DKIM enabled, as both Microsoft and we strongly recommend this for better email authentication.

To disable DKIM, go to Email & collaboration > Policies & rules > Threat policies > DomainKeys Identified Mail (DKIM). On the DKIM page, simply toggle the “Enable” button off to disable the protocol.

Enabling Microsoft Office 365 DKIM keys on your Defender account

Note: DKIM verification can help you better authenticate messages during special cases like email forwarding where SPF may fail. Keeping DKIM enabled for your domains is considered a good email practice and is highly recommended by both Microsoft, and us.

Final Thoughts

Setting up DKIM correctly is essential for securing your email communications and protecting your domain from spoofing and phishing attacks. Regularly checking and updating your DKIM configuration helps ensure your email authentication stays strong and effective.
To simplify this process and stay on top of your email security, consider using PowerDMARC — a powerful platform that makes managing and monitoring DKIM easy and reliable. Take a free DMARC trial to weigh out your benefits today.

Frequently Asked Questions

How do I ensure that DKIM is enabled for all Exchange Online domains?

To make sure DKIM is enabled for all your Exchange Online domains, check the Microsoft Defender portal under Email & collaboration > Policies & rules > Threat policies > DKIM. Verify that DKIM is turned on for each custom domain.

How to rotate DKIM keys in Office 365?

To rotate DKIM keys in Office 365, you need to generate new CNAME records for the new keys in your DNS and then enable DKIM signing for those new keys in the Microsoft Defender portal. This process helps improve security by periodically updating the cryptographic keys that sign your emails.

How often should you rotate DKIM keys?

It’s recommended to rotate your DKIM keys every 1 to 2 years, or sooner if you suspect your keys have been compromised. Regular rotation helps maintain strong email security and prevents attackers from exploiting old keys.

Microsoft Office 365 SPF setup

Microsoft Office 365 DMARC setup

Hope this article was helpful to you! Are you new to email authentication and DMARC? Take a free DMARC trial to weigh out your benefits today.

Latest posts by Yunes Tarada (see all)
Last Updated:
What Is Email Security? Types, Protocols, and TipsDMARCThe-Ultimate-Guide-to-Email-Security.-Types,-Protocols,-and-Best-PracticesHow to flush DNSHow to Flush DNS on Windows, Mac, Linux & Browsers