← All installation guides Email authentication and DNS

Set up Microsoft 365 DKIM for an Email Sender Seal

Publish both Microsoft 365 DKIM CNAME selectors, enable signing and identify the selector active on current mail.

M365
Recommended methodEmail DNS and seal setup
Email authentication setup

Configure email DNS and find the selector

  1. 1

    Open DKIM authentication

    In the Microsoft Defender portal open Email authentication settings and the DKIM tab, then select the custom sender domain.

  2. 2

    Copy both required CNAME values

    Use the exact selector1 and selector2 CNAME targets shown for your tenant. Do not construct them from an old example because Microsoft uses tenant-specific and newer dynamic record formats.

  3. 3

    Publish and enable

    Add both CNAME records at the authoritative DNS provider, wait until Microsoft detects them, then enable signing for the custom domain.

  4. 4

    Find the active selector

    Microsoft keeps selector1 and selector2 for key rotation but signs with one at a time. Send a new external message and read s= in the DKIM-Signature whose d= value matches the custom domain.

  5. 5

    Validate with VerifySeal

    Enter the active selector shown in the message header and run the email DNS check. Keep both CNAME records published for future Microsoft key rotation.

Open Microsoft 365 DKIM documentation ↗
Email Sender Verification Seal

Complete authentication before installing the seal

The sender domain must continue to publish a valid SPF record, the selected DKIM key and a DMARC policy. VerifySeal automatically rechecks these records according to the administrator schedule. For High Security messages, DKIM must cover the final Message-ID, VEM header and completed body.

  • SPF authorizes sending services
  • DKIM verifies the signed message domain
  • DMARC publishes the domain policy
Testing checklist

Confirm the installation is working

01

SPF

The sender domain has one valid SPF record containing every authorized sending service.

02

DKIM

A new external message reports DKIM pass and its matching signature contains the selector entered in VerifySeal.

03

DMARC

A DMARC record is published at _dmarc and its policy matches the organization’s approved rollout.

04

VerifySeal

The customer order reports SPF, DKIM and DMARC as verified before the Email Sender Seal is issued.

Platform notes
  • Every custom domain or sending subdomain used by Microsoft 365 needs its own DKIM configuration.