'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Disabled DKIM Key Rotation and Missing CNAME Records in Microsoft 365
Question details
The user is unable to enable DKIM key rotation for a custom domain because the required CNAME records are missing, leaving the feature disabled.
- Product
- Microsoft 365 Exchange Online
- Device & OS
- not provided
- Scenario
- Setting up email authentication and enabling DKIM key rotation for a custom domain in Microsoft 365.
- Observed behavior
- DKIM key rotation works for the default onmicrosoft.com domain, but the rotation toggle is disabled for a custom domain, returning an error that the required CNAME record does not exist.
Ensure you have administrative access to the Microsoft 365 Defender portal and the control panel of your domain's DNS hosting provider (e.g., GoDaddy, Cloudflare, or Route 53).
Create and Verify DKIM CNAME Records in DNS
Add the specific DKIM CNAME records provided by Microsoft to your domain's DNS settings to authenticate your custom domain and enable key rotation.
Microsoft 365 requires two specific CNAME records to be published in your domain's DNS zone before DKIM can be enabled. These records point your custom domain to Microsoft's DKIM keys, allowing the system to rotate them securely.
Log in to the Microsoft 365 Defender portal, navigate to Policies & rules > Threat policies > Email authentication settings > DKIM. Select your custom domain and copy the two required CNAME hostnames and target values.
Open a new tab and sign in to the platform where your domain's DNS is managed (your domain registrar or DNS hosting provider).
Navigate to the DNS management page and create a new record. Set the type to 'CNAME', paste the first selector hostname (e.g., selector1._domainkey), and set the target to the corresponding Microsoft value.
Repeat the process to create the second CNAME record using the second selector hostname (e.g., selector2._domainkey) and its target value, then save your changes.
Wait for the DNS changes to propagate. Return to the Microsoft 365 Defender portal, refresh the DKIM page, and click the toggle to enable DKIM signatures and key rotation for your custom domain.
Simplify Your Document Workflows with WPS Office
While managing complex domain security and DNS records in Microsoft 365 requires technical expertise, your daily document creation shouldn't. WPS Office provides a free, lightweight, and user-friendly alternative to Microsoft Office for all your personal and professional tasks.
Frequently Asked Questions
Why is the DKIM rotation button disabled for my custom domain?
The DKIM rotation toggle is disabled because Microsoft 365 checks your domain's DNS for the required CNAME records before allowing configuration. If the records are missing or haven't propagated yet, the option remains locked.
Why does DKIM work on my onmicrosoft.com domain without DNS changes?
Microsoft manages the DNS infrastructure for the default onmicrosoft.com domains, meaning DKIM and the necessary CNAME records are configured automatically behind the scenes. Custom domains require you to manually prove ownership and configure routing.
How do I check if my DKIM CNAME records have propagated?
You can use online DNS lookup tools like MxToolbox. Run a 'CNAME Lookup' for your selector hostnames (e.g., selector1._domainkey.yourdomain.com) to verify if the records are resolving to the correct Microsoft target values.
