DKIM checker for Microsoft 365

What this tool is

The DKIM Checker for Microsoft 365 checks whether a domain publishes the two DKIM selector records that Microsoft 365 uses. DKIM signs outgoing mail so receiving servers can verify the message really came from an authorized system and was not altered on the way. In Microsoft 365, publishing DKIM means two CNAME records, selector1 and selector2, under the _domainkey name of your domain, each pointing at the DKIM keys Microsoft holds for your tenant. This checker looks both of them up live and shows what they resolve to.

How to use

1. Type the domain you send from with Microsoft 365.
2. Click Check DKIM and wait for the live DNS lookups to finish.
3. Read the two selector rows and the verdict. If a selector is missing, publish its CNAME with the exact target shown in your Microsoft 365 admin, then recheck here.

How to read your results

• Both selectors published: DKIM publishing is complete for this domain. Signing still has to be switched on in the admin for mail to actually go out signed.
• selector1 published, selector2 missing: the most common partial setup. Mail usually verifies, because signing runs on the published selector, but the gap is worth closing before Microsoft rotates keys.
• Neither selector published: if Microsoft 365 sends for this domain, DKIM is not set up yet, whatever the sending dashboard implies.

Common problems

• DKIM never switched on. Publishing the CNAME records is only half of it. DKIM has to be enabled per domain in the Microsoft 365 Defender portal, on the DKIM page under the email authentication settings, or from the Exchange admin. Until it is on, nothing is signed.
• Records on the wrong domain. The CNAMEs belong under the exact sending domain. Publishing them on the main company domain does nothing for a secondary sending domain.
• Typos in the target. The CNAME target has to match the value the admin gives you character for character, including your tenant name. A near miss resolves to nothing.
• Checking too early. New DNS records take time to become visible everywhere. If you just published them and this page still shows them missing, wait and recheck before changing anything else.

FAQ

Where do I turn on DKIM for Microsoft 365?

In the Microsoft 365 Defender portal, on the DKIM page under the email authentication settings, also reachable from the Exchange admin center. You pick the domain, enable signing, and Microsoft shows you the two CNAME records to publish for it.

Why does Microsoft 365 use two selectors?

So the signing key can be rotated without downtime. One selector signs while the other stands ready, and Microsoft can move you between them without your mail failing verification in between.

selector1 works and selector2 is missing. Is that urgent?

Not urgent, and very common. Mail verifies on the published selector. Still fix it: rotation and future key changes rely on both being present, and discovering the gap during a rotation is the bad version of this lesson.

Does DKIM replace SPF or DMARC?

No. The three do different jobs. SPF lists who may send, DKIM signs what was sent, and DMARC tells receivers what to do when the checks fail and whether the sending identity lines up. Run the Email Authentication Checker to see the whole picture for a domain.

Does this checker work for domains that do not use Microsoft 365?

It only looks up the two Microsoft selectors. A domain sending through another provider signs with different selectors, and a missing result here only means the Microsoft 365 records are not published. Pair it with the SPF Checker for the rest of the picture.