AboutFree templates
How-to · DNS and domains

Set up DKIM for Microsoft 365 or Google Workspace

At the end, outgoing mail from your custom domain carries a DKIM signature that receiving servers can check against a record in your DNS.

Updated 4 Nov 20268 steps3 official sources
Start hereBack to the playbook
Before you start

What you need before step 1

Applies to: Custom domains in Microsoft 365 (Exchange Online) or Google Workspace (Gmail)

Admin roles you need

  • Microsoft 365: Microsoft's DKIM article does not name a single role for the Defender portal steps and advises least privilege. It states the optional Run Tests: DKIM check needs a Global Administrator.
  • Google Workspace: a super administrator (Google says you must be signed in as a super administrator to generate the key; the Gmail Settings administrator privilege is also listed)
  • A login to the DNS host account for the domain

Licences

None needed.

Download

BIND 9 from ISC (includes dig)Only needed on macOS or Linux if dig is missing. Windows has nslookup built in.https://www.isc.org/download/Download

Also have ready

  • The domain is added and verified in Microsoft 365 or Google Workspace
  • Google Workspace: Gmail has been active for 24 to 72 hours. Google says you must wait that long after enabling Gmail before you can get the DKIM key.
  • If your DNS is on Cloudflare: Microsoft says to turn off the Cloudflare proxy (orange cloud) on the DKIM CNAME records.
Step by step

8 steps

  1. 1

    Microsoft 365: open the DKIM tab

    Where: Microsoft Defender portal (security.microsoft.com) > Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM

    Sign in at https://security.microsoft.com and follow the menu path, or go straight to https://security.microsoft.com/authentication?viewid=DKIM. Skip to step 5 if you use Google Workspace.

    You should see: A list of your domains with a Toggle and a Status column.
  2. 2

    Microsoft 365: get the two CNAME values

    Where: Defender portal > Email authentication settings > DKIM > your domain

    Slide the Toggle from Disabled to Enabled. Because the DNS records do not exist yet, a Client error dialog opens showing the CNAME values, and the status becomes CnameMissing. Open the domain's details flyout and copy both entries under Publish CNAMEs. If the status is NoDKIMKeys instead, select Create DKIM keys first.

    You should see: You have two host names (selector1._domainkey and selector2._domainkey) and their two target values, which end in dkim.mail.microsoft for new domains or onmicrosoft.com for older ones.
  3. 3

    Microsoft 365: create the CNAME records

    Where: DNS host control panel > your domain > DNS records > Add record

    Add two records of Type CNAME (not TXT):

    • Name selector1._domainkey, target the selector1 value you copied
    • Name selector2._domainkey, target the selector2 value you copied

    Paste the values exactly; Microsoft says its examples are for illustration only. On Cloudflare, set the records to DNS only (proxy off). Select Save.

    You should see: Two CNAME records named selector1._domainkey and selector2._domainkey appear in the record list.
  4. 4

    Microsoft 365: turn on signing

    Where: Defender portal > Email authentication settings > DKIM > your domain flyout

    Wait for Microsoft 365 to detect the records (Microsoft says a few minutes or possibly longer). Open the domain flyout again and turn on Sign messages for this domain with DKIM signatures. Alternatively, in Exchange Online PowerShell (see the related how-to), check status and enable signing with the commands below.

    Get-DkimSigningConfig | Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME
Set-DkimSigningConfig -Identity contoso.com -Enabled $true
    You should see: The Status shows Signing DKIM signatures for this domain, and Rotate DKIM keys becomes available.
  5. 5

    Google Workspace: generate the DKIM key

    Where: Google Admin console (admin.google.com) > Menu > Apps > Google Workspace > Gmail > Authenticate email

    Choose your domain in Selected domain. Select Generate New Record. Choose a key length of 2048 if your DNS host supports 2048-bit keys, otherwise 1024. Leave the prefix selector as google unless that name is already used. Select Generate. Do not select Start authentication yet.

    You should see: The page shows a DNS host name (TXT record name) such as google._domainkey and a TXT record value starting v=DKIM1; k=rsa; p=. A message says DKIM authentication settings updated.
  6. 6

    Google Workspace: publish the TXT record

    Where: DNS host control panel > your domain > DNS records > Add record

    Add a record with Type TXT, Name / Host google._domainkey (or your selector followed by ._domainkey), and paste the full value. Select Save. If your host limits TXT length, see the TXT character limits section in Google's Troubleshoot DKIM issues article. Domains on Squarespace get this record automatically.

    You should see: A TXT record named google._domainkey appears with the v=DKIM1 value.
  7. 7

    Google Workspace: start authentication

    Where: Google Admin console > Apps > Google Workspace > Gmail > Authenticate email

    Return to the page, choose the domain, and select Start authentication. Google says it can take up to 48 hours for DKIM to start working, and a "You must update the DNS records for this domain" notice can stay for up to 48 hours.

    You should see: The status reads Authenticating email with DKIM.
  8. 8

    Check the DNS records

    Where: Command Prompt on Windows, or Terminal on macOS or Linux

    Query the records you created. Use the CNAME lines for Microsoft 365 and the TXT lines for Google Workspace.

    nslookup -type=CNAME selector1._domainkey.contoso.com
dig CNAME selector1._domainkey.contoso.com +short
nslookup -type=txt google._domainkey.contoso.com
dig TXT google._domainkey.contoso.com +short
    You should see: Microsoft: the CNAME target you pasted. Google: the v=DKIM1 value.
From experience

Expert tips

Set Cloudflare DKIM records to DNS only

Microsoft says the DKIM CNAME records must not be proxied. With the orange cloud on, lookups return Cloudflare's addresses instead of the CNAME target and DKIM fails. Set them to DNS only (grey cloud).

Move Microsoft 365 to 2048-bit keys

Microsoft 365 creates 1024-bit keys by default. After signing is on, run Rotate-DkimSigningConfig -Identity contoso.com -KeySize 2048. Microsoft notes rotation takes four days (96 hours) and the new size applies to the next selector, so a second rotation later moves both selectors to 2048.

Google: wait after activating Gmail

Google says you may need to wait 24 to 72 hours after turning on Gmail before you can generate the DKIM key, and up to 48 hours after adding the record before signing works. Keep the default google selector unless that name is already used.

Check the header, not just DNS

Send a message to an outside mailbox and look in Authentication-Results for dkim=pass, then check the d= value in the DKIM-Signature is your domain, not onmicrosoft.com or the provider's domain. Only your own domain in d= helps DMARC.

Sign mail from every other sender too

Newsletters, CRMs and help desks that send as your domain need their own DKIM set up at that service. Microsoft suggests a subdomain for these services, and each subdomain needs its own DKIM configuration.

Check it worked

How to confirm it worked

  • Send a message from your domain to an external mailbox (Google says sending to yourself will not verify DKIM). Open the headers (Gmail: More > Show original). The Authentication-Results line shows dkim=pass and the DKIM-Signature header shows d=contoso.com.

  • Microsoft 365: Get-DkimSigningConfig -Identity contoso.com | Format-List Enabled,Status returns Enabled True and Status Valid.

  • Google Workspace: Authenticate email shows Authenticating email with DKIM for the domain.

Undo

How to reverse it

Rollback:

Microsoft 365: turn off Sign messages for this domain with DKIM signatures in the flyout, or run Set-DkimSigningConfig -Identity contoso.com -Enabled $false. Google Workspace: follow Google's Turn off DKIM article, linked from the Set up DKIM help page. Leave the DNS records in place until signing has stopped, then delete them. If DMARC is at quarantine or reject, check SPF still passes before turning DKIM off.

Troubleshooting

Errors you might see

Status remains CnameMissing (Microsoft 365)

Cause: Microsoft lists a wrong host name, a TXT record created instead of a CNAME, or the records not yet detected.

Fix: Check the names are selector1._domainkey and selector2._domainkey, the type is CNAME, and wait longer before toggling again.

No DKIM keys saved for this domain (Microsoft 365)

Cause: Status NoDKIMKeys: no keys exist yet for the domain.

Fix: Select Create DKIM keys in the flyout, or run New-DkimSigningConfig -DomainName contoso.com -Enabled $false.

The DKIM toggle does not enable on a Cloudflare domain

Cause: Microsoft says the Cloudflare proxy (orange cloud) must be off on the DKIM CNAME records.

Fix: Set both records to DNS only and wait for detection.

The DKIM record was not created (Google Workspace)

Cause: Google says this can happen if you generate the key too soon after enabling Gmail.

Fix: Wait 24 to 72 hours after Gmail activation, then select Generate New Record again.

You must update the DNS records for this domain (Google Workspace)

Cause: Google can show this for up to 48 hours.

Fix: If the TXT record is correct in nslookup or dig, ignore it and check again later.

FAQ

Questions

Microsoft uses CNAME and Google uses TXT. Why?

That is how each vendor designed it. Microsoft has you publish two CNAMEs that point to records under a Microsoft domain, and offers Rotate DKIM keys in the portal. Google gives you the public key itself to publish as a TXT record.

Should I choose a 2048-bit or 1024-bit key in Google?

Google says choose 2048 if your DNS host supports it, otherwise 1024.

Do I need DKIM before DMARC?

Google says you must turn on SPF and/or DKIM and allow 48 hours before setting up DMARC.

Sources

Official sources

Vendors change menus and requirements. Confirm on the source before you rely on a detail. Last checked 4 Nov 2026.

Microsoft Learn: Set up DKIM to sign mail from your cloud domainGoogle Workspace Help: Set up DKIMGoogle Workspace Help: Set up DMARC (DKIM prerequisite)