MailFixIt

Microsoft 365 email configuration guide

Microsoft 365: DKIM record not verifying

Microsoft 365 cannot use DKIM for the custom domain until its selector CNAMEs resolve and signing is enabled.

Problem description

A provider setup symptom may look like:

DKIM record not verifying after a provider DNS change.

Check the sending domain

What this usually means

One or both Microsoft 365 DKIM selector CNAMEs are missing or wrong, the custom domain is not ready in the tenant, or DKIM signing has not been enabled.

Fix it

  1. In the Microsoft 365 tenant, select the exact accepted domain and copy its generated selector1 and selector2 CNAME targets.
  2. Publish both CNAMEs in the authoritative DNS zone. Tenant targets are domain-specific; do not copy them from another organization.
  3. Check for a duplicated domain suffix, a CNAME entered as TXT, or another record at the same selector name.
  4. After both CNAMEs resolve publicly, enable DKIM signing for the domain in Microsoft 365.
  5. Send a new external message and confirm that its d= domain aligns as intended and dkim=pass.

Common mistake

Publishing the two CNAMEs does not by itself enable signing. Likewise, enabling DKIM before the CNAMEs resolve will not create valid public keys.

What MailFixIt can check

MailFixIt can query the public selector records. It cannot enter the tenant or prove signing without a new message header.

Use the related DKIM guide if either selector is missing, points incorrectly, or returns an invalid key.

Frequently asked questions

What does MailFixIt check for Microsoft 365?

It can query the public selector records and detect missing or invalid DNS. Microsoft 365 must confirm that signing is enabled, and a new message must confirm dkim=pass.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Microsoft 365 official setup guidance.