Sign outgoing mail with DKIM for every sending domain

Description

DKIM signing is enabled in Exchange Online for every custom accepted domain that sends mail, with the two selector CNAME records (selector1._domainkey and selector2._domainkey) published in DNS and 2048-bit keys. Third-party services that send with the organization's domains sign with their own DKIM key for that domain.

Rationale

DKIM proves that a message was sent by an authorized system and was not altered on the way. It is the authentication result that survives forwarding and mailing lists, where SPF breaks, so DMARC depends on it to keep legitimate mail flowing once the policy is set to quarantine or reject. Without a custom DKIM signature, Exchange Online signs with the onmicrosoft.com domain, which does not align with the From domain.

Impact

None known on mail delivery. The CNAME records must exist before signing can be turned on.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM.
3. Check that every custom domain that sends mail shows Sign messages for this domain with DKIM signatures turned on, with status Valid.
4. In Exchange Online PowerShell (read-only):

   Get-DkimSigningConfig | Format-Table Domain, Enabled, Status, Selector1KeySize, Selector1CNAME, Selector2CNAME
   

   And check DNS: Resolve-DnsName selector1._domainkey.example.com -Type CNAME.
5. Fail if a sending domain has Enabled set to False, no signing configuration, missing CNAME records, or a 1024-bit key.

Remediation

1. In the Defender portal, on the DKIM tab, select the domain and copy the two CNAME values (or run Get-DkimSigningConfig -Identity example.com | Format-List Selector1CNAME, Selector2CNAME).
2. Publish the two CNAME records at the DNS hosting provider.
3. Back in the portal, turn on Sign messages for this domain with DKIM signatures. PowerShell equivalent (Security Administrator):

   New-DkimSigningConfig -DomainName example.com -KeySize 2048 -Enabled $true   # if no configuration exists
   Set-DkimSigningConfig -Identity example.com -Enabled $true
   

4. Upgrade 1024-bit keys with Rotate-DkimSigningConfig -Identity example.com -KeySize 2048.

Rollback

Set-DkimSigningConfig -Identity example.com -Enabled $false (mail is then signed with the onmicrosoft.com domain again).

References

• Set up DKIM to sign mail from your Microsoft 365 domain Microsoft, vendor-doc, accessed 2026-10-24
• Set-DkimSigningConfig Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Exchange Online baseline CISA, standard, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-108, ORCA-108-1) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-014 Publish an SPF record that fails unauthorized senders for every domain
• related CB-M365-MAIL-016 Publish an enforcing DMARC policy with reporting for every domain

People and lifecycle