Fix Missing DKIM Selector 1 TXT Record in Microsoft DNS
Question details
The user needs to resolve an issue where the DKIM selector 1 TXT record is missing or not resolving in Microsoft DNS, despite proper CNAME configurations.
- Product
- Microsoft DNS
- Device & OS
- not provided
- Scenario
- Setting up or troubleshooting DKIM email authentication for a domain hosted on Microsoft 365.
- Observed behavior
- The selector1 TXT record containing the public key is not published or resolvable in Microsoft DNS, and re-enabling DKIM or rotating keys via PowerShell does not fix the issue.
Ensure you have global or exchange administrator privileges for your Microsoft 365 tenant and administrative access to your domain's DNS management portal.
Verify DNS Delegation and Force DKIM Key Rotation via PowerShell
Use Exchange Online PowerShell to check the DKIM signing configuration and force a key rotation to regenerate the missing TXT record.
Sometimes the Microsoft backend fails to publish the initial DKIM TXT record properly. Forcing a manual key rotation can trigger the system to generate and publish the missing selector1 record.
Log in to your DNS provider and ensure the selector1 and selector2 CNAME records correctly point to your unique Microsoft 365 domain endpoints (e.g., selector1-domain-com._domainkey.contoso.onmicrosoft.com).
Open an elevated PowerShell window and run 'Connect-ExchangeOnline' to authenticate with your administrator credentials.
Run 'Get-DkimSigningConfig -Identity yourdomain.com' to view the current status of your DKIM keys and confirm the expected DNS record values.
Execute the command 'Rotate-DkimSigningConfig -Identity yourdomain.com -KeySize 2048' to force the system to generate a new set of keys and update the DNS records.
Open a Support Ticket with Microsoft 365
If the record is still missing after key rotation and propagation, the backend tenant configuration may be stuck and requires Microsoft Support.
Try WPS Office for Seamless Document Management
While you troubleshoot backend IT configurations like DNS and DKIM records, simplify your daily workflow with WPS Office. It provides a lightweight, highly compatible, and fully featured alternative to Microsoft Office for all your document needs.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the Software: Run the downloaded installer and follow the simple on-screen instructions to set up the office suite on your device.
- 3. Start Creating: Open WPS Office to instantly begin editing your existing Microsoft Office files without losing any formatting.
Frequently Asked Questions
Why is only DKIM selector 1 missing while selector 2 resolves properly?
This is typically caused by a synchronization glitch in the Microsoft 365 backend during the initial key generation process. While the secondary key (selector 2) publishes correctly, the primary key (selector 1) may get stuck and fail to publish.
How long should I wait for DKIM DNS records to propagate?
Standard DNS propagation can take anywhere from a few minutes to 72 hours. However, if the Microsoft backend has not generated the record, no amount of waiting will resolve it without a forced key rotation or support intervention.
Can I manually publish the missing TXT record instead of using CNAMEs?
While technically possible, Microsoft 365 strongly recommends using CNAME records. CNAMEs allow Microsoft to automatically handle DKIM key rotation for enhanced security without requiring you to manually update TXT records every time.
