DKIM explained: signing your email in Microsoft 365 and Google Workspace

How DKIM works

DKIM (RFC 6376) works with a pair of keys for each signing set-up:

1. The sending service holds a private key and uses it to sign important headers (such as From, To, Subject and Date) and the message body.
2. The signature goes into a DKIM-Signature header. Its d= value names the signing domain and its s= value names the selector, which says which key was used.
3. The receiving server looks up the public key in DNS at selector._domainkey.signingdomain (for example google._domainkey.example.co.uk) and checks the signature.
4. If the signed parts were not changed in transit, DKIM passes for the signing domain.

Selectors let one domain have several keys at once, one for each service that sends for you, and let you rotate keys without downtime. A message can carry more than one signature: many hosted services sign with their own domain and then again with yours once you set it up.

Because the signature travels with the message, DKIM usually survives forwarding, which SPF does not; the NCSC highlights this as DKIM's advantage. It breaks if something changes the signed content after signing, such as a gateway adding a footer. Google warns that outbound gateways must not interfere with DKIM for exactly that reason.

DKIM vs SPF vs DMARC

The three standards answer different questions, which is why mailbox providers now ask for all of them:

The key point is alignment. DKIM can pass for a provider's own domain while DMARC still fails for yours. For DMARC to pass on DKIM, the d= domain must match your From domain, which is why you need DKIM signing with your own domain on every service. Our sister site's DMARC guide covers the policy side, and our SPF record page covers the other half.

How to enable DKIM in Microsoft 365

Microsoft 365 automatically signs mail from your initial onmicrosoft.com domain, but it does not sign with your custom domain until you turn it on, so mail from example.co.uk will not pass DMARC on DKIM until you do. Microsoft's steps:

1. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings and open the DKIM tab.
2. Select your custom domain. If no keys exist yet, try to switch it on: Microsoft creates the keys and shows the two CNAME records you need.
3. At your DNS host, create two CNAME records, selector1._domainkey and selector2._domainkey, pointing to the values Microsoft shows. Domains added since May 2025 use a newer format ending in dkim.mail.microsoft; copy the values exactly.
4. Wait for Microsoft 365 to detect the records, then switch on Sign messages for this domain with DKIM signatures.
5. Check that the status reads Signing DKIM signatures for this domain, then send a test message and confirm DKIM passes for your domain.

Microsoft's troubleshooting notes cover the usual errors. Create both CNAME records even though only one selector is active, because the second is used for key rotation. Do not publish a TXT record with a key instead of the CNAMEs: Microsoft manages the keys, and a TXT record is not supported. And watch DNS hosts that append your domain automatically, which turns selector1._domainkey.example.co.uk into a record ending example.co.uk.example.co.uk. Do not publish DKIM records for parked domains: Microsoft says the absence of a key is what makes forged DKIM fail.

How to enable DKIM in Google Workspace

In Google Workspace you generate the key in the Admin console and publish it as a TXT record. You need to be a super administrator, and Google says to wait 24 to 72 hours after turning on Gmail before generating a key.

1. In the Google Admin console go to Menu > Apps > Google Workspace > Gmail and click Authenticate email.
2. Choose the domain and click Generate new record. Select a 2048-bit key if your DNS host supports it (1024 if not), and keep the default prefix selector google unless that selector is already in use.
3. At your DNS host, add a TXT record named google._domainkey with the value shown, which starts v=DKIM1; k=rsa; p= followed by the key.
4. Allow time for DNS to update; Google says DKIM can take up to 48 hours to start working.
5. Back in Authenticate email, click Start authentication. The status should change to Authenticating email with DKIM.

Some DNS hosts limit the length of a TXT record, which can trip up 2,048-bit keys; your host's documentation will say how to enter long values. If you route outbound mail through a gateway, make sure it does not change messages after Google has signed them. Our Gmail security settings guide covers the rest of the Admin console.

DKIM for third-party senders

Every other service that sends as your domain needs its own DKIM set-up: marketing platforms, CRMs, helpdesks, finance and payroll systems, and gateways that relay your outbound mail. Most offer a domain authentication option that gives you one or more DNS records to publish under their own selectors.

A few rules keep this tidy. Use a different selector for each service, so one change cannot break another. Check that a new service does not try to reuse a selector you already have (Google warns about this for its default google selector). Keep a list of which selector belongs to which service, so old keys can be removed when a contract ends. Microsoft recommends putting services you do not directly control on a subdomain, and each subdomain needs its own DKIM set-up. DMARC reports will show any sender that is passing DKIM only for its own domain, which is the sign that its DKIM is not yet set up for yours.

Key length and key rotation

Longer keys are harder to break. Google requires DKIM keys of at least 1,024 bits for mail to personal Gmail accounts and recommends 2,048 bits; Yahoo recommends a minimum of 1,024 bits. Choose 2,048 bits wherever your DNS host and sending service support it.

Keys should also be changed from time to time, as you would change a password. In Microsoft 365, open the domain on the DKIM tab and choose Rotate DKIM keys. Microsoft says it takes four days (96 hours) for the new key to start signing, and you cannot start another rotation until it finishes. A rotation can also move the key size from 1,024 to 2,048 bits through Exchange Online PowerShell; Microsoft notes the new size applies to the next active selector on the first rotation. For other services, follow each provider's own rotation process, and publish the new public key before the old one is retired.

Hosted tools help here: Valimail automates DKIM alongside SPF and DMARC, and IRONSCALES DMARC lets you manage DKIM keys from its portal.

How to check DKIM

To check DKIM for a message, open its headers (in Gmail, More, then Show original). The DKIM-Signature header shows the d= signing domain and s= selector, and the authentication results show whether DKIM passed and for which domain. For DMARC, the passing domain must match your From address.

To check the record itself, look up selector._domainkey.yourdomain with a DNS lookup or DKIM checker tool, using the selector from the header. In Microsoft 365, the DKIM tab in the Defender portal shows the status of every domain, and the Exchange Online PowerShell cmdlet Get-DkimSigningConfig lists the selectors, status and rotation dates. DMARC aggregate reports then show DKIM results for every source sending as your domain.

How we help

Forever Systems can turn on DKIM for every custom domain in Microsoft 365 or Google Workspace, set up DKIM with your domain on each third-party service, move keys to 2,048 bits, plan rotation and use DMARC reports to check every sender aligns. We supply hosted options such as Valimail and IRONSCALES DMARC where managing keys by hand would be a burden; pricing is confirmed at quote. Contact us to get DKIM working across your domains.