skip to Main Content

Configure DKIM record for Office 365

In the previous article, we had a look at how to configure the SPF record for Office 365. An excellent way to protect both senders and recipients from phishing mail is to configure a DKIM record for Office 365. In this article, we will look at how to configure and enable DKIM record for Office 365.

What is DomainKeys Identified Mail (DKIM)?

DomainKeys Identified Mail (DKIM) is an authentication process that can help protect both senders and recipients from forged and phishing email. Add DKIM signatures to your domains, so recipients know that email messages actually came from users in your organization and weren’t modified after they were sent.

Check Office 365 DKIM status

Sign in to Microsoft 365 security center. Click on Policies & rules.

Microsoft 365 security center

Click on Threat Policies.

Microsoft 365 threat policies

Click on DKIM.

Configure DKIM record for Office 365 DKIM policy

Another option is to go straight to the link https://security.microsoft.com/dkimv2.

Click on the domain in the list view. In this example, the domain exoip.com.

Configure DKIM record for Office 365 domain

Click on Create DKIM keys to enable DKIM.

Note: DKIM is by default disabled for every domain you add in Office 365. Microsoft can’t automatically enable this as it relies on certain DNS records added to the domain’s registrar.

Configure DKIM record for Office 365 create DKIM keys

A message will show that it can’t enable DKIM because the CNAME record does not exist for this config. That’s correct because we need to add a couple of CNAMES in the domain’s registrar. After that, we will return to this page and enable DKIM.

Click Copy.

Publish DKIM CNAMEs

Office 365 DKIM records example

An example of how the DKIM records look like for the domain exoip.com:

 selector1._domainkey CNAME selector1-exoip-com._domainkey.exoip365.onmicrosoft.com
 selector2._domainkey CNAME selector2-exoip-com._domainkey.exoip365.onmicrosoft.com

If you want to add more than one domain, change the domain and tenant. Everything else looks the same.

Get Office 365 DKIM selector with PowerShell

Run PowerShell as administrator and Connect to Exchange Online PowerShell.

PS C:\> Connect-ExchangeOnline -UserPrincipalName admin@exoip365.onmicrosoft.com

Run the cmdlet Get-DkimSigningConfig including the domain.

PS C:\> Get-DkimSigningConfig -Identity exoip.com | fl Selector1CNAME,Selector2CNAME

Selector1CNAME : selector1-exoip-com._domainkey.exoip365.onmicrosoft.com
Selector2CNAME : selector2-exoip-com._domainkey.exoip365.onmicrosoft.com

Add Office 365 DKIM CNAME records to domain’s registrar

Go to the domain’s registrar. Add the two CNAME records.

Note: Pay close attention as some registrars want you to add a dot at the end of the value, and others don’t. You can verify by checking other records and see if they have a dot at the end of their value. If you are not sure, contact your domain’s registrar.

In our example, a dot needs to be added at the end of the value. It will look like below.

Name                   TTL      Type    Value
----                   ---      ----    -----
selector1._domainkey   5 min.   CNAME   selector1-exoip-com._domainkey.exoip365.onmicrosoft.com.
selector2._domainkey   5 min.   CNAME   selector2-exoip-com._domainkey.exoip365.onmicrosoft.com.
Configure DKIM record for Office 365 publish selectors in domain's registrar

We have to wait 15 minutes to an hour before changes take effect.

Enable Office 365 DKIM

Go back to the Microsoft 365 security center and Enable DKIM for Office 365.

Configure DKIM record for Office 365 status enabled

DKIM record check

Check DKIM record with MxToolbox. Fill in the domain name and selector1. Click DKIM Lookup.

DKIM record lookup MxToolbox selector1

The DKIM selector1 record is published.

DKIM record lookup MxToolbox selector1 results

Change the lookup field to selector2 and click on DKIM Lookup. The DKIM selector2 record is published.

DKIM record lookup MxToolbox selector2 results

We did successfully configure the DKIM record for the domain in Office 365.

No DKIM Record found

Suppose you get a result that shows No DKIM Record found.

DKIM record lookup MxToolbox No DKIM Record found

Go back to the Microsoft 365 security center and click on Rotate DKIM keys.

Rotate DKIM keys

Wait a couple of minutes and check again in MxToolbox. It will show the result DKIM record found.

In the next article, we will change Users UPN with PowerShell.

Conclusion

You learned how to configure DKIM record for Office 365. Sign in to the Microsoft 365 security portal and go to the DKIM policy. Enabling DKIM for the domain will not work without first creating the CNAME records in the domain’s registrar.

Sign in to the domain’s registrar and publish the CNAME records selector1 and selector2. After that, wait for 15 minutes before enabling DKIM in Microsoft 365 security portal. You can always use MxToolbox to perform a DKIM record test against the domain name and selector for a valid published DKIM key record.

Did you enjoy this article? You may also like Add second domain to Exchange Server. Don’t forget to follow us and share this article.

ALI TAJRAN

ALI TAJRAN

ALI TAJRAN is a passionate IT Architect, IT Consultant, and Microsoft Certified Trainer. He started Information Technology at a very young age, and his goal is to teach and inspire others. Read more »

This Post Has 3 Comments

  1. Thanks for all your great posts. Trying to understand DKIM a bit better. If you have a hybrid environment and set dkim up only in the office 365 side, how does this affect emails sent from on-premise mailboxes that don’t yet route through 365?

    Thanks,
    B

Leave a Reply

Your email address will not be published.