How to Manually Rotate the Second DKIM Selector in Microsoft 365
Question details
The user needs to manually rotate the alternate (second) DKIM selector in Microsoft 365 to a new 2048-bit key.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Upgrading Microsoft 365 domain DKIM keys from 1024-bit to 2048-bit security standards.
- Observed behavior
- The first DKIM selector (Selector1) updates successfully to the new 2048-bit key, but Selector2 continues to use the older 1024-bit key and requires manual rotation.
Ensure you have the Exchange Online PowerShell module installed and are logging in with an account that has Exchange Administrator permissions in your Microsoft 365 tenant.
Use PowerShell to Force the DKIM Selector Rotation
Execute the Rotate-DkimSigningConfig cmdlet in Exchange Online PowerShell to manually generate new keys and switch to the alternative selector.
While Microsoft 365 is designed to automatically handle the rotation of selectors for accepted domains, propagation delays or upgrading processes can sometimes leave the second selector stuck on an older 1024-bit key. You can force this rotation manually using PowerShell cmdlets.
Open PowerShell as an administrator and connect to your tenant using the 'Connect-ExchangeOnline' cmdlet.
Run 'Get-DkimSigningConfig -Identity yourdomain.com | Format-List' (replacing yourdomain.com with your actual accepted domain) to verify the current key sizes and rotation status.
Execute the command 'Rotate-DkimSigningConfig -Identity yourdomain.com' to force the creation of new 2048-bit DKIM keys on the alternative selector.
Allow up to 72 hours for the new DKIM keys to fully propagate across the Microsoft 365 network and global DNS.
Manage Your Daily Documents Effortlessly with WPS Office
While resolving complex Exchange Online domain security policies requires Microsoft admin tools, managing your daily word processing, spreadsheets, and presentations shouldn't be complicated. WPS Office provides a lightweight, highly compatible, and completely free alternative to Microsoft Office desktop apps.
Frequently Asked Questions
Why didn't my second DKIM selector update automatically?
Microsoft 365 generally rotates selectors for accepted domains automatically to maintain security. However, during major upgrades (such as shifting from 1024-bit to 2048-bit keys), syncing issues or propagation delays can cause one selector to remain on the old configuration, necessitating a manual rotation.
Do I need to update my public DNS records after rotating the selector manually?
If Microsoft 365 manages your DNS, the records are updated automatically. If you manage your own DNS using a third-party provider, your existing CNAME records should already point to Microsoft's endpoints, meaning you typically do not need to make changes to your DNS zone file unless the CNAMEs themselves were deleted or altered.
What happens if I run the Rotate-DkimSigningConfig command multiple times?
Running the command multiple times before the initial rotation has propagated can cause conflicts or do nothing at all. It is highly recommended to run the command once and wait the standard 72-hour propagation window before attempting further configuration changes.
