How to set up DKIM for Microsoft 365, Google Workspace and others

DKIM signs each message with a private key held by your mail provider. Receivers fetch the public key from DNS at <selector>._domainkey.<your domain> and check the signature.

Microsoft 365 (selector1 and selector2)

1. In the Microsoft Defender portal, open Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM, and select your domain. It shows the two CNAME records to publish. In Exchange Online PowerShell:

   Get-DkimSigningConfig -Identity example.com | Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME

2. Publish both CNAMEs at your DNS host, using the exact targets Microsoft shows. Domains added since May 2025 use targets under dkim.mail.microsoft; older domains use your onmicrosoft.com domain. For example:

   selector1._domainkey.example.com.  CNAME  selector1-example-com._domainkey.contoso.n-v1.dkim.mail.microsoft.
   selector2._domainkey.example.com.  CNAME  selector2-example-com._domainkey.contoso.n-v1.dkim.mail.microsoft.

   The contoso and n parts depend on your tenant: copy them, do not guess them.
3. Turn signing on once the CNAMEs resolve: the toggle on the same page, or Set-DkimSigningConfig -Identity example.com -Enabled $true.

Microsoft signs with one selector at a time and switches to the other when it rotates keys, so keep both CNAMEs published.

Google Workspace

1. In the Admin console, go to Apps > Google Workspace > Gmail > Authenticate email, pick the domain and generate a new record with a 2048-bit key. The default selector is google.
2. Publish the TXT record it shows:

   google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

   Some DNS hosts need a long key split into several quoted strings in one record; that is normal.
3. Back in the Admin console, click Start authentication.

Every other sender

Newsletter, CRM, ticketing and transactional mail services sign with their own selectors (for example s1 and s2, k1, mandrill or amazonses). Each one documents the CNAME or TXT records to add for your domain. Set them up so that service signs as your domain, not its own; that is what lets DMARC pass for it.

Keys and checks

• Use 2048-bit RSA keys. 1024-bit keys still validate, but are weak by current standards; rotate them.
• Remove the records of services you no longer use.
• Read a key: dig +short TXT selector1._domainkey.example.com. A CNAME is followed automatically.
• Find which selector a message used: the s= value in its DKIM-Signature header.