How to Fix Microsoft 365 DKIM Shows None or Fails Validation
Question details
Users need to resolve an issue where Microsoft 365 DomainKeys Identified Mail (DKIM) signatures show as 'none' or fail validation, affecting email authentication.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Verifying email authentication settings for outbound Microsoft 365 messages to ensure high deliverability and prevent emails from being marked as spam.
- Observed behavior
- Email message headers show DKIM as 'none' or 'fail', which typically happens due to unsigned messages, incorrect DNS public keys, or external mail gateways modifying the message body after signing.
Ensure you have administrator access to the Microsoft 365 Defender portal and login credentials for your domain's DNS hosting provider to verify or update records.
Inspect Original Message Headers for DKIM Signatures
Verify if the email actually contains a valid DKIM signature before assuming a DNS configuration error, as forwarder headers can be misleading.
Often, validation appears to fail because administrators look at the wrong header. The 'Authentication-Results-Original' header is used by email forwarders and will normally show 'none' if the message was not forwarded.
Open the failing email message in your email client and access its original internet headers or raw message source.
Search for the 'DKIM-Signature' header, which is usually located just above the 'Authentication-Results-Original' header.
Check that the 'd=' tag matches your Microsoft 365 domain (e.g., d=contoso.com) and the 's=' tag matches your configured selector (e.g., s=selector1).
Verify DNS Records and Mail Gateway Routing
Ensure your DNS records correctly publish the public key and that no external services are altering your emails after they are sent.
Boost Your Productivity with WPS Office
While troubleshooting complex Microsoft 365 email routing and server configurations, consider streamlining your local document workflow with WPS Office. It's a highly compatible, free, and lightweight alternative to Microsoft Office that lets you view, edit, and create documents without heavy subscription models.
- 1. Download the installer: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install the software: Run the setup file and follow the brief on-screen instructions to complete the installation.
- 3. Start creating: Open WPS Office to instantly begin working on your text documents, spreadsheets, and presentations.
Frequently Asked Questions
Why does Authentication-Results-Original show DKIM as 'none'?
The Authentication-Results-Original header is typically used by email forwarders. If the email message was not forwarded, it is completely normal for this header to show a 'none' value. You should inspect the actual 'DKIM-Signature' header instead.
Can an email disclaimer cause DKIM validation to fail?
Yes. If an email gateway, third-party service, or a local server appends a disclaimer or modifies the email body in any way after Microsoft 365 has applied the DKIM signature, the cryptographic hash will break, resulting in a validation failure.
How do I check if my DKIM DNS records are correct?
You can check your DKIM configuration by verifying the CNAME records for your domain's selectors (e.g., selector1._domainkey) in your DNS provider's control panel. Ensure they point exactly to the hostnames provided in the Microsoft 365 Defender portal.
What should I do if my DKIM is properly configured but still fails?
If you have verified that your public and private keys match, your DNS records are accurate, and no mail gateways are altering your messages, you should open a service request in the Microsoft 365 admin center so Microsoft support can investigate the backend routing.
