Publish the domain-specific DKIM records Microsoft provides, enable outbound signing, and verify the result.
Why this matters
DKIM adds a cryptographic signature to mail sent from your domain so receiving systems can verify that the message was signed by an authorized sender. Microsoft 365 already signs mail from the initial onmicrosoft.com domain, but a custom sending domain requires its own setup. DKIM works alongside SPF and DMARC; it is not a complete anti-spoofing policy by itself.
Before you start
Make sure the custom domain has been added to Microsoft 365 and appears on the DKIM tab in Microsoft Defender. You also need permission to change DNS at the domain’s DNS host. Inventory third-party services that send as your domain, because Microsoft 365 DKIM only covers mail it signs; those other services need their own authentication arrangements.
Configure the custom domain
- Open Microsoft Defender at security.microsoft.com, then Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
- Select the custom domain. If it has no DKIM keys yet, Microsoft’s current instructions have you try enabling it, acknowledge the initial CNAME-missing dialog, then reopen its details.
- Copy the two exact CNAME names and targets shown in the domain’s Publish CNAMEs section. Create both records at your DNS host. Do not reuse example values from a guide; Microsoft says record values can vary by domain and tenant.
- Wait for DNS publication and detection. In the domain details, enable Sign messages for this domain with DKIM signatures.
- Confirm the portal reports that DKIM signatures are being applied for the domain. Send a message to an external test mailbox and inspect its authentication results.
If activation fails
Check the hostnames and targets against the values in Defender, including punctuation, and allow time for DNS to propagate. If the domain is already configured, avoid recreating records without checking the current state. A valid DKIM signature does not guarantee DMARC alignment for every other sender using the same visible domain; audit those senders separately.
Sources
Microsoft Learn: Configure DKIM for a custom domain; Microsoft Learn: Email authentication in Microsoft 365.
