DKIM Cannot Be Enabled: Microsoft 365 "No Verified Default Selector" Fix

Last updated 2026-09-23 — By The InboxGreen Team

This error appears in Microsoft 365 Defender when you try to enable DKIM but the two CNAME records Microsoft requires have not been published yet, or have not fully propagated. Microsoft 365 does not use a plain TXT DKIM key — it uses two CNAME records that point to Microsoft's key infrastructure. The fix is to publish both CNAMEs in your DNS provider, wait for propagation, and then return to Defender to enable DKIM.

What it means

When Microsoft 365 checks for DKIM readiness, it looks for two CNAME records at <code>selector1._domainkey.yourdomain.com</code> and <code>selector2._domainkey.yourdomain.com</code>. If either is missing or has not propagated, Defender displays "DKIM cannot be enabled for the domain as no verified default selector present." Microsoft manages the actual signing keys on its own infrastructure — the CNAMEs simply delegate signing authority to Microsoft's servers.

Why it matters

Without DKIM enabled in Microsoft 365, outbound emails from your domain carry no cryptographic signature. Receiving servers cannot verify that messages were sent by Microsoft on your behalf. This can reduce inbox placement, fail DMARC alignment checks, and make your domain easier to spoof.

How to fix it

Step 1: Get the CNAME records from Microsoft

  1. Go to the Microsoft 365 Defender portal (security.microsoft.com).
  2. Navigate to Email & Collaboration → Policies & Rules → Threat Policies → Email Authentication Settings.
  3. Click the DKIM tab and select your domain.
  4. Microsoft shows two CNAME records. Copy both exactly — they look like: selector1._domainkey.yourdomain.com → selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

Step 2: Publish the CNAMEs in Cloudflare

  1. Log in to Cloudflare and open your domain → DNS → Records → Add record.
  2. Type: CNAME
  3. Name: selector1._domainkey (Cloudflare adds your domain automatically)
  4. Target: paste the full target value Microsoft provided for selector1
  5. Proxy status: DNS only (grey cloud)
  6. Repeat for selector2._domainkey.
  7. Save both records and wait 15-30 minutes before returning to Defender.

Step 2: Publish the CNAMEs in Namecheap

  1. Log in to Namecheap → Domain List → Manage → Advanced DNS → Add New Record.
  2. Type: CNAME Record
  3. Host: selector1._domainkey
  4. Value: paste the full target value Microsoft provided for selector1
  5. Repeat for selector2._domainkey.
  6. Save and wait 15-30 minutes before returning to Defender.

Step 2: Publish the CNAMEs in GoDaddy

  1. Log in to GoDaddy → My Products → DNS → Manage Zones → select your domain → Add Record.
  2. Type: CNAME
  3. Name: selector1._domainkey
  4. Value: paste the full target value Microsoft provided for selector1
  5. Repeat for selector2._domainkey.
  6. Save and allow 30-60 minutes for GoDaddy propagation before returning to Defender.

Step 3: Enable DKIM in Defender

  1. After DNS propagation, return to Microsoft 365 Defender → Email Authentication Settings → DKIM.
  2. Select your domain and click "Enable". Microsoft verifies the CNAMEs resolve correctly before activating signing.
  3. Once enabled, the status changes to "Signing DKIM signatures for this domain." If it fails again, wait another 15-30 minutes and retry.

How to verify the fix

  1. After enabling in Defender, send a test email to a Gmail address.
  2. Open the email → three-dot menu → Show original. Look for dkim=pass in the authentication results section.
  3. From command line: dig CNAME selector1._domainkey.yourdomain.com +short should return the Microsoft delegation target.
  4. Or use the InboxGreen DKIM Checker with selector selector1.

Check your fix right now

Run your domain through InboxGreen's free checker to confirm the issue is resolved.

Check my domain

Common mistakes

  • Adding a TXT record with a DKIM key value instead of a CNAME. Microsoft 365 requires CNAME records, not a TXT key. Delete any manually added TXT records for these selectors.
  • Only adding one of the two CNAME records. Microsoft 365 requires both selector1._domainkey and selector2._domainkey before it will enable DKIM.
  • Testing too quickly. DNS propagation for CNAME records can take 15-60 minutes. Clicking Enable in Defender before propagation causes the same error.
  • Setting the CNAME to Proxied in Cloudflare. DNS records for email authentication must be set to DNS only (grey cloud).

Frequently asked questions

Why does Microsoft 365 use CNAME records instead of a TXT key? +

Microsoft manages DKIM key rotation automatically for Microsoft 365 domains. By using CNAME delegation, they can rotate the underlying keys on their infrastructure without requiring you to update DNS each time. The CNAMEs point to Microsoft servers that hold the actual public keys.

I published both CNAMEs but the error still appears. What now? +

Wait at least 30-60 minutes after publishing. DNS propagation can lag, especially with GoDaddy or some registrars with slow TTLs. Verify the CNAMEs resolve with dig CNAME selector1._domainkey.yourdomain.com before retrying in Defender.

Do I need to do anything after enabling DKIM in Microsoft 365? +

No ongoing action is needed. Microsoft rotates keys automatically between selector1 and selector2. You should also check DMARC is configured correctly so the DKIM signature aligns with your From domain.

Related fix guides