Security Policy Errors

How to Remove an Old DKIM TXT Record in Microsoft 365

Algirdas Jasaitis Sep 30, 2026 868 views

Question details

The user needs to remove obsolete DKIM TXT records that continue to appear in Microsoft 365 after a domain has been transferred or deleted.

How to Remove an Old DKIM TXT Record After Transferring a Microsoft 365 Domain

Product: Microsoft 365
Device & OS: not provided
Scenario: A domain has been transferred or deleted from the tenant, but its associated DKIM TXT records still appear in the system.
Observed behavior: Old DKIM records remain visible under the tenant's onmicrosoft.com domain, though they typically do not prevent mail delivery.

Before you start

Ensure you have global or Exchange administrator privileges in Microsoft 365, as well as access to the management console of your authoritative DNS hosting provider.

Solution 1Recommended

Verify and Update DNS Records at Your DNS Provider

Use this solution to manually remove the obsolete DKIM TXT records directly from your authoritative DNS host, which is the primary source of truth for domain routing.

Microsoft 365 reads your DNS configuration from your authoritative DNS host. To permanently clear old DKIM entries, you must delete them directly at the provider where your domain's nameservers are currently pointed.

While lingering records in the Microsoft 365 interface rarely disrupt active mail delivery, keeping your DNS zone clean prevents future authentication conflicts.

Log in to your DNS hosting provider

Navigate to the website of your current DNS host (e.g., GoDaddy, Cloudflare, Route 53) and log in with your administrative credentials.

Access the DNS management zone

Locate the specific domain you have transferred or modified and click to open its DNS Management or Zone Editor page.

Locate the DKIM TXT or CNAME records

Filter the list of records by type 'TXT' or 'CNAME'. Look for records starting with 'selector1._domainkey' or similar DKIM identifiers related to your old Microsoft 365 setup.

Delete the obsolete records

Click the 'Delete' or 'Remove' button next to the old DKIM records and save your zone file changes. Allow up to 48 hours for DNS propagation.

Verify and Update DNS Records at Your DNS Provider

Verify Mail Connectors: While logged into the Microsoft 365 Admin Center, double-check your Accepted Domains and Mail Connectors to ensure no old routing rules are attempting to use the deleted domain.

Solution 2

Open a Support Request in Microsoft 365 Admin Center

Use this approach if you have already cleaned your external DNS but 'ghost' DKIM records remain undeletable inside the Microsoft 365 tenant interface.

Free Microsoft Office alternative

Looking for a Lightweight, Reliable Office Alternative?

While you manage your server configurations and email security in Microsoft 365, you can rely on WPS Office for all your document creation needs. It offers a familiar interface, lightning-fast performance, and deep compatibility with standard office files.

1. Download the software: Visit the official WPS website and click the free download button for your operating system.
2. Run the installer: Open the downloaded file and follow the on-screen instructions to complete the fast installation.
3. Open your documents: Launch WPS Office and immediately open any existing Microsoft Office files without losing your formatting.

100% compatible with Microsoft Word, Excel, and PowerPoint formats (DOCX, XLSX, PPTX)Lightweight installation that consumes minimal system resourcesFamiliar ribbon interface requiring zero learning curveFree built-in PDF editing and conversion toolsIdeal for users migrating away from expensive enterprise subscriptions

Frequently Asked Questions

Will an old DKIM TXT record affect my current email delivery?

Generally, obsolete DKIM records left over from a deleted or transferred domain do not prevent mail delivery. However, it is a best practice to remove them to maintain a clean DNS zone and avoid potential authentication confusion.

Why does Microsoft 365 still show records for a domain I transferred?

Microsoft 365 sometimes retains residual DKIM or domain configurations under the default tenant 'onmicrosoft.com' domain. These are known as ghost records and typically require Microsoft Support intervention to manually purge if they cannot be deleted via the UI.

Where is the correct place to delete a DKIM TXT record?

You must delete the DKIM TXT record directly at your authoritative DNS hosting provider (e.g., GoDaddy, Namecheap, Cloudflare), as this is the system that controls how the internet resolves your domain's email authentication policies.

How long does it take for a deleted DKIM record to disappear?

Once you delete the TXT record at your DNS provider, it can take anywhere from a few minutes up to 48 hours for the changes to propagate globally across the internet.

Microsoft Office Security Issues