DKIM and DMARC for Microsoft 365

Set them up in this order: SPF first (see the SPF guide for Microsoft 365), then DKIM, then DMARC starting at p=none. SPF lists who may send for your domain, DKIM signs each message, and DMARC tells receiving servers what to do when a message fails both.

Turn on DKIM in Microsoft 365

1. Open the Microsoft Defender portal at security.microsoft.com and go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings, then open the DKIM tab and select your domain.
2. While signing is not set up, the status shows CnameMissing. The page shows the two records you need to publish. Copy them from there; you can also read them with the PowerShell command Get-DkimSigningConfig -Identity yourdomain.com | Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME.
3. At your DNS host, add two CNAME records with the host names selector1._domainkey and selector2._domainkey. The value each one points to is different for every domain, so always use the values Microsoft shows you and never copy them from an example.
4. Wait for Microsoft to detect the records. That takes a few minutes, and sometimes longer.
5. Return to the DKIM tab, select the domain and switch signing on. Once it is on, the option to rotate keys becomes available.

To confirm it, send a message to a mailbox that is not your own and read the Authentication-Results header: it should show a DKIM pass for your domain. Mailing yourself does not prove it.

Add the DMARC record

Microsoft 365 has no setting for DMARC on your own domain. You add one TXT record at your DNS host, with the host name _dmarc. Set up SPF and DKIM for every domain and subdomain you send from first, and send the reports to a dedicated mailbox or group rather than a person’s inbox.

• v=DMARC1 marks the record as DMARC.
• p=none is the policy. It asks receivers to take no action on failures, so you can read the reports before you enforce anything.
• rua=mailto:... is where the daily summary reports go. They arrive as compressed XML files, so a DMARC reporting service can make them readable.

Move from none to quarantine to reject

Microsoft recommends a gradual roll-out. Start at p=none and watch the reports. When all of your legitimate mail passes, move to p=quarantine and raise pct step by step (10, 25, 50, 75, 100), then do the same with p=reject. If you have several domains or subdomains, begin with one that sends little mail and leave the main domain for last. Go slowly: a strict policy blocks your own mail if you forgot a sender, such as a CRM or a newsletter tool.

Check both records

Use the DKIM checker with the selectors selector1 and selector2, and the DMARC checker. The domain check looks at SPF, DKIM, DMARC and MX in one run, and the DMARC record generator builds the record for you.

Common mistakes

• Switching signing on before the records are found. Wait until the status no longer says CnameMissing.
• Copying example values. The two CNAME targets belong to your domain only.
• Two DMARC records. A domain has one.
• The wrong host. The DMARC host is _dmarc, not the root of the domain.
• Forgetting an outreach or newsletter tool. Put tools you do not control on a subdomain with its own records, so they cannot hurt the main domain.
• Jumping straight to reject. Start at p=none.

Sources

The steps follow Microsoft’s own guides: DKIM and DMARC. Using Google Workspace? See DKIM and DMARC for Google Workspace.