'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Unable to Create DKIM Keys in Microsoft 365 Exchange Online
Question details
The user is unable to create DKIM keys for a verified domain and receives an 'Error in retrieving encrypted key' message.
- Product
- Microsoft 365 Exchange Online
- Device & OS
- not provided
- Scenario
- Attempting to create a DKIM configuration using New-DkimSigningConfig in PowerShell or via the Microsoft Defender portal.
- Observed behavior
- The domain appears correctly in Get-AcceptedDomain, but DKIM key creation fails with an 'Error in retrieving encrypted key' prompt.
Ensure you have Exchange Administrator or Global Administrator privileges in your Microsoft 365 tenant before attempting to modify DKIM configurations.
Verify Domain and Submit a Support Request
Since this error involves backend encryption services and sensitive tenant data, it requires intervention from the Microsoft 365 support team after verifying standard settings.
The 'Error in retrieving encrypted key' issue usually indicates a synchronization problem or a backend encryption provisioning failure within Exchange Online. Because this deals with secure tenant data, public forums cannot resolve it, and Microsoft Support must address it remotely.
Run the 'Get-AcceptedDomain' command in Exchange Online PowerShell to ensure your domain is fully configured and accepted.
Run the 'New-DkimSigningConfig' command again to see if the error was a temporary glitch.
Log in to the Microsoft 365 admin center and navigate to the 'Support' or 'Help & support' section.
Create a new support ticket detailing the 'Error in retrieving encrypted key' message. Request the backend team to investigate your domain's DNS configuration and encryption services.
Need a Reliable Alternative for Your Daily Office Tasks? Try WPS Office
While advanced Exchange Online administration requires Microsoft 365 tools, managing your everyday documents, spreadsheets, and presentations shouldn't be complicated. WPS Office provides a lightweight, highly compatible, and free alternative to standard Microsoft Office applications.
- 1. Download the installer: Visit the official WPS Office website and click the Free Download button.
- 2. Install the software: Run the downloaded installer and follow the quick setup wizard to install the suite on your device.
- 3. Start creating and editing: Open WPS Office to immediately start working on your documents, spreadsheets, and presentations with full format compatibility.
Frequently Asked Questions
Why do I get the 'Error in retrieving encrypted key' message when setting up DKIM?
This error typically occurs due to a backend synchronization issue in Exchange Online where the encryption keys fail to provision properly for your tenant. It usually requires Microsoft Support to refresh or reset the background services.
Can I fix this DKIM error without contacting Microsoft Support?
Generally, no. Since the issue involves backend encryption services and sensitive tenant data, it cannot be fixed via standard PowerShell commands or the Defender portal UI once the accepted domain check has passed.
What permissions do I need to create DKIM keys in Exchange Online?
You need to be a member of the Organization Management or Security Administrator role groups in Microsoft 365 to run the New-DkimSigningConfig command and manage DKIM settings.
How long does DKIM take to propagate once successfully configured?
After the keys are successfully generated and the CNAME records are added to your DNS provider, it can take anywhere from a few hours up to 48 hours for the DNS changes to fully propagate globally.
