Security Policy Errors

How to Upgrade Microsoft 365 DKIM Keys from 1024-Bit to 2048-Bit

Nimra Malik Oct 21, 2026 868 views

Question details

The user needs to upgrade their Microsoft 365 domain's DKIM keys from the older 1024-bit standard to a more secure 2048-bit key, which requires safely rotating keys and managing external DNS records.

Upgrading Microsoft 365 DKIM Keys from 1024-Bit to 2048-Bit

Product: Microsoft 365
Device & OS: not provided
Scenario: Enhancing email domain security and avoiding policy errors by upgrading DKIM cryptographic keys to a stronger 2048-bit encryption standard.
Observed behavior: Successfully rotating the DKIM keys in Microsoft 365, publishing the new 2048-bit CNAME records in the external DNS provider, and ensuring valid DKIM signatures for all outbound emails.

Before you start

Ensure you have global administrator or Exchange administrator privileges in Microsoft 365, as well as access to the control panel of your domain's external DNS hosting provider.

Solution 1Recommended

Rotate and Upgrade DKIM Keys via Microsoft 365 Defender

Use the Microsoft 365 Defender portal to safely initiate the DKIM key rotation and generate the new 2048-bit CNAME records for your DNS host.

When you enable or rotate DKIM in Microsoft 365, the system defaults to generating 2048-bit keys if supported by your domain configuration. It is critical to carefully update your external DNS records before completing the rotation to prevent email authentication failures and dropped messages.

Access Email Authentication Settings

Log in to the Microsoft 365 Defender portal. Navigate to 'Policies & rules', select 'Threat policies', then choose 'Email authentication settings', and finally click on 'DKIM'.

Initiate DKIM Key Rotation

Select your specific domain from the list. If DKIM is already enabled with 1024-bit keys, click on the 'Rotate DKIM keys' button to prompt the system to generate new 2048-bit CNAME targets.

Log in to External DNS Host

Open a new tab and log in to your external DNS hosting provider (such as GoDaddy, Cloudflare, or Route53) and navigate to the DNS management zone for your domain.

Update CNAME Records

Locate the existing CNAME records for 'selector1._domainkey' and 'selector2._domainkey'. Edit these records to point to the new target values provided by the Microsoft 365 portal.

Confirm Rotation

Wait for DNS propagation (which can take a few hours). Return to the Microsoft 365 Defender portal and confirm the DKIM rotation to finalize the upgrade to 2048-bit keys.

DNS Propagation Validation: Use external DNS lookup tools to verify that your new DKIM CNAME records have successfully propagated worldwide before confirming the new keys in Microsoft 365.

Solution 2

Upgrade DKIM Keys Using Exchange Online PowerShell

For advanced administrators, Exchange Online PowerShell offers a direct and scriptable method to rotate DKIM keys to the 2048-bit standard.

Free Microsoft Office alternative

Boost Your Productivity with WPS Office

Managing Microsoft 365 backend infrastructure and DNS policies can be complex, but handling your daily documents doesn't have to be. WPS Office is a highly compatible, lightweight, and free alternative suite for seamlessly creating, editing, and sharing your important files.

1. Download the Installer: Visit the official WPS Office website and click the download button for your operating system.
2. Install the Software: Run the downloaded installation file and follow the simple on-screen instructions to complete the setup.
3. Start Creating: Launch WPS Office to instantly begin editing Word, Excel, PowerPoint, and PDF documents for free.

Seamlessly handles DOCX, XLSX, and PPTX formats, ensuring full Microsoft Office format compatibility.A secure and reliable productivity environment, ideal for drafting server security policies and IT deployment plans offline.Lightweight application that runs smoothly on both older machines and modern hardware.Familiar user interface requires no learning curve for former Microsoft Office users.

microsoft office alternative - wps office

Frequently Asked Questions

Why should I upgrade my DKIM keys from 1024-bit to 2048-bit?

2048-bit keys provide a significantly higher level of cryptographic security. This makes it exponentially harder for attackers to spoof, forge, or decipher your domain's emails compared to the older, more vulnerable 1024-bit standard.

Will upgrading my DKIM key interrupt my email flow?

If done correctly, rotating and upgrading your DKIM keys will not interrupt email flow. Microsoft continues to sign your emails with the active old key until the new key rotation is fully completed and propagated in your DNS.

How long does it take for the new 2048-bit DKIM keys to take effect?

After updating your CNAME records in your external DNS host, it typically takes anywhere from a few minutes to up to 48 hours for the DNS changes to fully propagate globally across the internet.

What happens if I don't update my external DNS records after rotating keys in Microsoft 365?

If you rotate the keys in the Microsoft 365 portal but fail to update your external DNS records, recipient mail servers will not be able to verify your new DKIM signatures. This mismatch will likely cause your legitimate emails to be rejected or marked as spam by receivers.

Microsoft Office Security Issues