Security Policy Errors

How to Upgrade Office 365 DKIM Selector to a 2048-Bit Key

Camila Milosovich Oct 21, 2026 868 views

Question details

The user needs to upgrade DKIM selector 2 from a 1024-bit key to a 2048-bit key in Office 365 and determine if external DNS records require updating.

How to Upgrade an Office 365 DKIM Selector to a 2048-Bit Key

Product: Office 365
Device & OS: not provided
Scenario: Upgrading domain email security by rotating a DKIM selector to a higher encryption standard.
Observed behavior: The goal is to safely generate and apply a 2048-bit DKIM key while maintaining proper DNS configuration for email delivery.

Before you start

Ensure you have Exchange Administrator or Global Administrator privileges in Microsoft 365, as well as access to your domain's DNS hosting provider.

Solution 1Recommended

Rotate the DKIM Key and Update External DNS Records

Generate a new 2048-bit DKIM key for the specific selector using Microsoft 365 Defender and update your public DNS records.

Microsoft 365 defaults to 2048-bit keys when new DKIM keys are generated. To upgrade an existing 1024-bit selector, you must initiate a key rotation. This process requires you to update the CNAME records in your external DNS before the new key is fully enforced.

Access Microsoft 365 Defender

Sign in to the Microsoft 365 Defender portal using your admin credentials. Navigate to 'Policies & rules', select 'Threat policies', and click on 'DomainKeys Identified Mail (DKIM)'.

Select the Domain and Rotate Keys

Click on the domain you want to manage. Locate the specific selector (e.g., selector 2) and choose the option to rotate DKIM keys. The system will provide new CNAME record values.

Update External DNS Records

Log in to your domain's external DNS hosting provider (e.g., GoDaddy, Cloudflare). Locate your existing DKIM CNAME records and update them with the new values provided by Microsoft 365.

Verify and Enable

Wait for the DNS changes to propagate across the internet. Return to the Microsoft 365 Defender portal and complete the rotation process to enable the new 2048-bit key.

Rotate the DKIM Key and Update External DNS Records

DNS Propagation Timing: Always publish the new public key in your external DNS records and allow sufficient time for propagation (often 1 to 24 hours) before fully enabling the rotated selector to prevent temporary email delivery issues.

Free Microsoft Office alternative

Experience a Lightweight Alternative to Microsoft Office

While Office 365 handles complex email administration like DKIM keys, you might be looking for a streamlined, cost-effective solution for your document editing needs. WPS Office provides a free, highly compatible alternative to Microsoft Word, Excel, and PowerPoint.

1. Download: Visit the official WPS Office website to download the free installer for your operating system.
2. Install: Run the setup file and follow the straightforward on-screen instructions to install the suite.
3. Edit Documents: Open your existing Microsoft Office files instantly with complete formatting compatibility.

Fully compatible with Microsoft Office document formats (.docx, .xlsx, .pptx).Free and lightweight, avoiding the heavy resource usage of traditional office suites.Familiar interface ensures a seamless migration with zero learning curve.Built-in PDF editing, conversion, and cloud collaboration tools.

microsoft office alternative - wps office

Frequently Asked Questions

Why should I upgrade my Office 365 DKIM key to 2048-bit?

A 2048-bit DKIM key offers much stronger cryptographic security than an older 1024-bit key, making it significantly harder for malicious actors to crack the encryption and spoof your domain's emails.

Do I need to change my external DNS records when rotating DKIM keys?

Yes. Whenever a new DKIM key is generated or rotated in Microsoft 365, you must publish the corresponding new public key by updating the CNAME records in your domain's external DNS hosting provider.

Will rotating my DKIM key disrupt my outbound email delivery?

Email delivery will remain unaffected as long as you follow the proper rotation sequence: publish the new DNS records first, allow them to propagate globally, and only then finalize the rotation in the Microsoft 365 admin center.

Microsoft Office Security Issues