Security Policy Errors

How to Rotate DKIM Keys in Microsoft 365

Rana Garcia Oct 10, 2026 868 views

Question details

The user wants to know if Microsoft 365 offers a built-in schedule feature for automatically rotating DKIM keys to maintain email security.

How to Automate or Rotate DKIM Keys in Microsoft 365

Product: Microsoft 365
Device & OS: not provided
Scenario: Maintaining organizational email security policies by regularly updating DomainKeys Identified Mail (DKIM) signatures.
Observed behavior: Microsoft 365 currently lacks a built-in automatic rotation schedule for DKIM keys, requiring administrators to execute the rotation manually or build custom scripts.

Before you start

Ensure you have global administrator or security administrator permissions in your Microsoft 365 tenant and possess the credentials required to access Exchange Online via PowerShell or the Microsoft Defender portal.

Solution 1Recommended

Automate DKIM Rotation using PowerShell and Task Scheduler

Create a securely authenticated PowerShell script and schedule it via Windows Task Scheduler to automate your DKIM key rotations without manual intervention.

While Microsoft 365 previously handled DKIM rotations automatically, this process now requires manual execution or custom automation. Using PowerShell paired with Windows Task Scheduler is the most effective way to restore an automated rotation schedule for enterprise environments.

Prepare the PowerShell environment

Open PowerShell as an Administrator and install or import the Exchange Online Management module by running 'Import-Module ExchangeOnlineManagement'.

Create the rotation script

Write a PowerShell script that uses 'Connect-ExchangeOnline' to authenticate with your administrator credentials (ideally using certificate-based authentication for automation) and executes the 'Rotate-DkimSigningConfig' cmdlet for your domains.

Configure Windows Task Scheduler

Open Windows Task Scheduler, create a new Basic Task, and set the trigger to your preferred rotation schedule (e.g., every 6 months). Set the action to 'Start a program' and point it to powershell.exe with the path to your script in the arguments field.

Automate DKIM Rotation using PowerShell and Task Scheduler

Automation Setup: Automating this task with a secure script ensures your organization meets email security compliance consistently without relying on manual portal logins.

Solution 2

Rotate DKIM Keys Manually in the Microsoft Defender Portal

Use the web-based Microsoft Defender portal to manually cycle your DKIM keys if you prefer a graphical interface over scripting.

Free Microsoft Office alternative

Looking for a Lightweight Office Suite? Try WPS Office

Managing Microsoft 365 security policies like DKIM can be complex and requires enterprise administration tools. However, your daily document tasks shouldn't be. WPS Office provides a free, lightweight alternative to Microsoft Office, offering powerful productivity tools without the heavy administrative overhead.

1. Download the software: Visit the official WPS website and download the free installation package for your operating system.
2. Install WPS Office: Run the installer and follow the simple on-screen instructions to set up the software in minutes.
3. Open your files: Launch WPS Office and instantly open, edit, or save your existing Microsoft Word, Excel, and PowerPoint documents.

Fully compatible with Microsoft Office formats, including .docx, .xlsx, and .pptx files.Secure local document editing without requiring complex cloud administration portals or PowerShell scripts.Lightweight installation package with exceptionally fast launch speeds.Familiar user interface ensuring seamless migration and zero learning curve.Completely free for everyday document creation and editing.

Frequently Asked Questions

How often should I rotate my DKIM keys in Microsoft 365?

Security best practices generally recommend rotating DKIM keys every 6 to 12 months. This minimizes the risk of a compromised key being used to spoof your organization's emails.

Do I need to update my DNS records when rotating Microsoft 365 DKIM keys?

If you originally configured your domain using Microsoft's provided CNAME records for DKIM, you do not need to update your DNS records. The key rotation happens seamlessly on Microsoft's backend.

Why did my automated PowerShell script fail to rotate the keys?

Common reasons for script failure include expired authentication tokens, lacking the necessary Exchange Online admin permissions, or conditional access policies blocking the automated login. Utilizing certificate-based authentication for your automated scripts is highly recommended.

Can I check when my DKIM keys were last rotated?

Yes. You can verify the last rotation date by connecting to Exchange Online via PowerShell and running the 'Get-DkimSigningConfig -Identity yourdomain.com' cmdlet to view the key details.

Microsoft Office Security Issues