Security Policy Errors

How to Fix Microsoft 365 DKIM Failure No Key for Signature

Emma Brown Oct 20, 2026 870 views

Question details

The user is experiencing DKIM validation failures in Microsoft 365 for a specific domain and selector, which causes legitimate newsletter messages to be flagged as junk.

How to Fix Microsoft 365 DKIM Failure: No Key for Signature

Product: Microsoft 365
Device & OS: not provided
Scenario: Sending outbound newsletter emails where messages are delivered to the recipient's junk mail folder due to DMARC and DKIM validation failures.
Observed behavior: Microsoft 365 reports 'dkim=fail (no key for signature)' in the message headers, even though other email providers validate the DKIM signature successfully.

Before you start

Ensure you have administrator access to the Microsoft 365 modern Exchange admin center and can communicate with the affected recipient to obtain original email headers.

Solution 1Recommended

Analyze Message Headers and Run an Extended Message Trace

Investigate the root cause by reviewing the original message headers and tracing the email path using the modern Exchange admin center.

Since other email providers are successfully validating the DKIM signature, the issue may be related to DNS caching or specific lookup failures within Microsoft 365. An extended message trace will reveal exactly how Exchange is handling the DKIM selector and DNS queries.

Obtain Original Headers

Ask the recipient to extract and provide the original message headers from the junk email they received. This will confirm the exact DKIM selector being used and failing.

Access Exchange Admin Center

Run an Extended Message Trace

Navigate to 'Mail flow' > 'Message trace'. Start a new trace specifying the sender and recipient, and select 'Extended report' to capture comprehensive DKIM and DNS lookup details.

Analyze the Trace Data

Review the downloaded extended report to identify why Microsoft 365 failed to find the DKIM key for the specific selector, checking for DNS propagation delays or selector mismatches.

Analyze Message Headers and Run an Extended Message Trace

Handle Data Securely: When sharing or reviewing message headers and trace logs with Microsoft support, ensure you use a secure and private channel, as they may contain sensitive network and user information.

Free Microsoft Office alternative

Boost Your Productivity with WPS Office

While managing email server configurations requires specialized admin tools, your daily document tasks shouldn't be complicated. WPS Office provides a free, lightweight, and fully compatible alternative to Microsoft Office for creating, editing, and sharing documents effortlessly.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Free and lightweight suite requiring minimal system resources.Familiar user interface ensuring a seamless migration with zero learning curve.Built-in PDF editing tools for comprehensive document management.

microsoft office alternative - wps office

Frequently Asked Questions

Why does DKIM fail with 'no key for signature' in Microsoft 365?

This error occurs when the receiving server (Microsoft 365) cannot find the public key published in the sender's DNS records for the specified DKIM selector. This can be caused by DNS propagation delays, incorrect DNS configuration, or a mismatch in the selector name.

How can other providers pass DKIM while Microsoft 365 fails?

Different email providers cache DNS records differently. If a DKIM record was recently updated or newly published, other providers might see the new record while Microsoft 365 is still relying on outdated cached DNS data.

Where can I find the modern Exchange admin center to run a trace?

You can access the modern Exchange admin center by logging into the Microsoft 365 admin center, expanding the left-hand navigation menu, and selecting 'Exchange' under the Admin centers section.

Microsoft Office Security Issues