There are two methods of enabling DKIM for Microsoft. This can be through Microsoft 365 Defender or through PowerShell. Below are the two methods of enabling DKIM.
Before getting started in enabling DKIM for Office 365 we first have to create the selectors needed to add to your DNS. There are two main parts that need to be populated into the DKIM key. The rest is standard across the board for Office 365.
We will need to combine both of those parts to form the DKIM records we need to enter. I have an example below how these records should look.
Once the DKIM records have been created, enter them in your DNS so it can begin to propagate globally. If this is not done before enabling DKIM we have to wait until this happens before we can enable DKIM in Office 365.
Microsoft 365 Defender/msdyn_blobfile/$value)
/msdyn_blobfile/$value)
/msdyn_blobfile/$value)
Publish your Office 365 DKIM CNAME records:
Enable DKIM through PowerShell/msdyn_blobfile/$value)
/msdyn_blobfile/$value)
/msdyn_blobfile/$value)
/msdyn_blobfile/$value)
/msdyn_blobfile/$value)
If the domain doesn't exist in the list, create and enable it by running the PowerShell command below./msdyn_blobfile/$value)
/msdyn_blobfile/$value)
Before getting started in enabling DKIM for Office 365 we first have to create the selectors needed to add to your DNS. There are two main parts that need to be populated into the DKIM key. The rest is standard across the board for Office 365.
- We need to identify the customDomainIdentifier. This can be found in your Office 365 MX record. It is the first piece before mail.protection.outlook.com.
- We need to identify the initialDomain. This can be found from in your DMARC reports or header of any messages you send from Office 365. This is the .onmicrosoft.com domain for your tenant.
We will need to combine both of those parts to form the DKIM records we need to enter. I have an example below how these records should look.
| Action | Domain | DNS Type | Host | Value |
| ADD | domain.com | CNAME | selector1._domainkey | selector1-customDomainIdentifier._domainkey.intitialDomain |
| ADD | domain.com | CNAME | selector2._domainkey | selector2-customDomainIdentifier._domainkey.intitialDomain |
Once the DKIM records have been created, enter them in your DNS so it can begin to propagate globally. If this is not done before enabling DKIM we have to wait until this happens before we can enable DKIM in Office 365.
- You can check a DNS record at https://dnschecker.org
Microsoft 365 Defender
- Login to Microsoft 365 Defender (https://sip.security.microsoft.com/homepage). You can click on the link provided.
- In the portal, navigate and click on Policies & rules under Email & collaboration
- In Policies & rules page, select Threat polices
- Then select DomainKey Identified Mail(DKIM) to open the DKIM page.
- On the DKIM page, select the domain you want to enable DKIM for.
- You can then toggle the Enable button to start the activation process for DKIM. A dialogue box will appear which may contact the following status:
- A pop-up will now display with your DKIM CNAME records
- Rotate the DKIM key to be 2048 bit length (This adds extra security).
Publish your Office 365 DKIM CNAME records:
- Login to your DNS provider's management console as the admin
- Navigate to the DNS records section.
- Create new CNAME records (Make sure the record type is CNAME)
- Add the hostname and values that was provided in the Defender portal.
- Keep TTL as 3600.
- Save changes to your record. Wait for about 24 to 48 hours for the DNS records to propagate.
Enable DKIM through PowerShell
- If the Admin enabling DKIM has never connected to Exchange Online through PowerShell, then install the Exchange Online PowerShell module.
- Set-ExecutionPolicy RemoteSigned
- Install-module -Name ExchangeOnlineManagement
- Once you have installed the module, connect to Exchange Online PowerShell.
- Connect-ExchangeOnline
- Run the following command to see existing domain ready to enable DKIM.
- Get-DkimSigningConfig
- If the domain exists in the list, enable DKIM signing for the domain.
- Set-DkimSigningConfig -Identity domain.com -Enabled $true
If the domain doesn't exist in the list, create and enable it by running the PowerShell command below.
- New-DkimSigningConfig -DomainName domain.com -KeySize 2048 -Enabled $true
- Rotate the DKIM key to be 2048-bit length (This adds extra security).
- Rotate-DkimSigningConfig -KeySize 2048 -Identity domain.com
- Run the following command to see the current DKIM configuration. Confirm DKIM has been enabled and bit length has been rotated.
- Get-DkimSigningConfig -Identity domain.com | Format-List
- Once you have confirmed DKIM has been enabled and bit length has been rotated, verify your message is passing DKIM by sending yourself a test message and analyzing the header of the message.