How to Troubleshoot a DKIM Selector 2 DNS Record in Microsoft 365
Question details
The user needs to resolve an issue where DKIM selector 1 resolves properly but selector 2 fails or is missing in Microsoft 365.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Configuring domain email security and DKIM signing policies in Microsoft 365.
- Observed behavior
- DKIM selector 2 DNS record fails to resolve, showing as missing, incorrect, or returning a 'no DKIM record found' error, causing domain alignment issues.
Ensure you have administrative access to both your Microsoft 365 Defender portal and your domain registrar's DNS management dashboard.
Verify and Update DNS Records for Selector 2
Check your domain provider's settings to ensure the selector 2 CNAME or TXT record is accurately published.
A common cause of DKIM selector 2 failures is a missing or mistyped DNS record. Microsoft 365 requires two specific CNAME records for DKIM to function perfectly for high availability.
Log in to your domain hosting provider (e.g., GoDaddy, Cloudflare, Route 53) and navigate to the DNS management settings for your domain.
Search for the CNAME records related to DKIM, which are usually formatted as selector1._domainkey and selector2._domainkey.
Confirm that the hostname and the target destination value for selector 2 match exactly what was provided in your Microsoft 365 setup instructions. Correct any typos if found.
Save the corrected DNS record. Be aware that DNS changes can take up to 48 hours to fully propagate globally.
Re-enable DKIM in Microsoft 365
Once the DNS record is verified and propagated, recheck the DKIM configuration within Microsoft 365 to activate it.
Boost Your Productivity with WPS Office
While troubleshooting Microsoft 365 domain issues can be time-consuming, handling your daily document tasks shouldn't be. WPS Office is a free, lightweight, and highly compatible alternative that lets you create, edit, and share documents seamlessly without complex backend administrative configurations.
Frequently Asked Questions
Why does DKIM selector 1 resolve but selector 2 fails?
This typically happens if the second CNAME record was omitted during the initial DNS setup, entered with a typo in the hostname or target value, or hasn't had enough time to propagate across global DNS servers.
How long does it take for a DKIM DNS record to propagate?
DNS propagation can take anywhere from 15 minutes to 48 hours depending on your domain provider and the TTL (Time to Live) settings of your DNS zone.
What is the format for a Microsoft 365 DKIM CNAME record?
Microsoft 365 DKIM records typically require a CNAME record formatted as `selector1._domainkey.yourdomain.com` pointing to `selector1-yourdomain-com._domainkey.onmicrosoft.com`. Ensure you follow the exact values generated in the Defender portal for both selectors.
Can I use third-party tools to check my DKIM records?
Yes, you can use various free online DNS and DKIM lookup tools. Simply enter your domain name and the specific selector (e.g., selector2) to see if the record is publicly resolvable and returning the correct values.
