Where do I publish the DKIM record for Microsoft 365?

You publish DKIM as a TXT record at selector._domainkey.yourdomain.com, where selector is the name given by Microsoft 365.

How do I know if DKIM is working?

Send a message to a Gmail inbox and look at Show original. If DKIM shows PASS for your domain, the record is working.

Yes. Many providers support multiple selectors to rotate keys or support several sending systems.

Step by step DKIM setup for Microsoft 365: complete instructions, examples, verification commands, and common pitfalls.

Want to check your domain while following this guide?

Run a free SPF, DKIM and DMARC check on your domain to see exactly what is passing and what needs fixing.

No signup required. Works on any domain.

This is a reference guide for configuring DKIM on Microsoft 365. Use it while editing DNS or when troubleshooting deliverability.

Tip: Avoid common mistakes: follow these steps to add DKIM on Microsoft 365. Then verify everything with the InboxGreen Free Checker.

Microsoft 365 DKIM requires enabling signing per domain in the Security center. The DNS CNAME records can exist but DKIM still fails until signing is turned on.
SPF is simple, but tenants using multiple mail flows often forget to add their marketing or transactional tool's include alongside the Microsoft include.
Microsoft 365 admin → Settings → Domains → Pick domain → View DNS records.

In Microsoft 365, generate a DKIM key and note the selector. Providers often suggest something like selector1 and selector2.

Microsoft 365 admin → Settings → Domains → Pick domain → View DNS records.

Create a TXT record at host selector._domainkey (replace selector with your actual selector name).
Paste the full value starting with v=DKIM1; k=rsa; p= and save.
Wait for DNS propagation.

Send a test email to a Gmail address and use “Show original” to confirm “DKIM: PASS”.

Or run:

dig TXT selector._domainkey.yourdomain.com +short

Using the wrong host so the record becomes selector._domainkey.yourdomain.com.yourdomain.com.
Breaking the value by wrapping or truncating the TXT string.
Publishing a record for the wrong selector and then validating on another.

Pro tip: Turn on InboxGreen Monitoring to check these records daily and get alerts if something breaks.

Check SPF, DKIM, DMARC and List-Unsubscribe for your domain in seconds.