'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix DKIM Public Key TXT Record Publishing Error
Question details
The user needs to resolve a DKIM public key publishing error that prevents proper custom-domain email authentication.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Configuring custom-domain email authentication and DKIM records in the DNS provider.
- Observed behavior
- A publishing error occurs, usually caused by missing, incorrectly named, or conflicting DNS records, or pending DNS propagation.
Ensure you have administrator access to both your email provider's admin center (such as Microsoft 365 Defender) and your domain's DNS hosting dashboard.
Verify and Update DKIM CNAME or TXT Records
Check your domain's DNS host to ensure the correct DKIM records are published and free of conflicts.
A common cause of DKIM publishing errors is incorrectly formatted DNS records or duplicate entries. Ensuring your DNS host matches the exact requirements provided by Microsoft 365 is critical for authentication.
Log in to the control panel of your domain registrar or DNS hosting provider where your domain's nameservers point.
Navigate to the DNS management or Advanced DNS settings page for your custom domain.
Ensure the CNAME or TXT records provided by your email provider (e.g., selector1._domainkey) exactly match the generated names and values.
Delete any duplicate or obsolete DKIM records for the same selector that might be causing conflicts with the new keys.
Enable DKIM in Microsoft 365 Defender
Once DNS records are fully propagated, attempt to enable DKIM signing in the Microsoft 365 Defender portal.
Manage Your IT Documentation with WPS Office
While troubleshooting domain and DNS configurations in Microsoft 365, you can rely on WPS Office as a lightweight, free alternative for your daily document needs. It offers a familiar interface and seamless compatibility without the heavy subscription costs.
- 1. Visit the WPS website: Go to the official WPS Office website to download the free installation package.
- 2. Install the software: Run the installer and follow the on-screen instructions to set up WPS Office on your computer.
- 3. Start creating documents: Open WPS Writer, Spreadsheet, or Presentation to manage your IT documentation easily.
Frequently Asked Questions
Why does my DKIM record still show an error after adding it to my DNS?
DNS records require time to propagate globally. Even if you have entered the correct TXT or CNAME record, it may take up to 48 hours for your email provider to detect the changes.
Should I use a CNAME or TXT record for Microsoft 365 DKIM?
Microsoft 365 typically recommends using CNAME records for DKIM configuration, as it allows Microsoft to automatically rotate the cryptographic keys for better security. However, some legacy or custom setups may require TXT records.
How do I know what my DKIM selector value should be?
Your DKIM selector values (usually selector1 and selector2) and their corresponding target values are generated automatically inside the Microsoft 365 Defender portal under the DKIM email authentication settings.
