On this page

Fixing DKIM in Cloudflare for Microsoft 365

What this fixes

DKIM lets receiving servers verify your mail hasn't been altered in transit and really came from you. See Fixing DKIM Record Issues for what it does and why it matters.

Important: unlike most DNS-based email checks, Microsoft 365's DKIM record is a CNAME, not a TXT record — and you need two of them.

Step 1: Get your exact CNAME values from Microsoft

  1. Go to the Microsoft Defender portal (security.microsoft.com) → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM tab. (Direct link: security.microsoft.com/authentication?viewid=DKIM.)
  2. Select your domain. If DKIM isn't yet configured, Microsoft shows you the two CNAME records to publish first.
  3. Copy the two selector names and their target values exactly as shown — the target isn't always something.onmicrosoft.com (domains added since mid-2025 get a different target pattern), so don't assume the format from a template. Copy it from the portal or via Get-DkimSigningConfig in Exchange Online PowerShell.

You'll get two records, typically named selector1._domainkey and selector2._domainkey.

Step 2: Publish both in Cloudflare

For each of the two records:

  1. Log in to the Cloudflare dashboard and select your domain.
  2. Go to DNS → Records → Add record.
  3. Set Type to CNAME.
  4. Name: the selector Microsoft gave you (e.g. selector1._domainkey).
  5. Target: the exact value Microsoft gave you.
  6. Set Proxy status to DNS only (grey cloud) — a proxied CNAME here will break DKIM validation.
  7. Click Save.
  8. Repeat for the second record.

Step 3: Turn on DKIM signing

  1. Back in the Defender portal's DKIM tab, wait for DNS to propagate, then toggle the domain to Enabled.
  2. Confirm Sign messages for this domain with DKIM signatures is on.
  3. Re-run your scan to confirm.

Common pitfalls

  • Proxying the CNAME (orange cloud) — DKIM validation needs the actual CNAME chain resolvable, not Cloudflare's proxy.
  • Hardcoding a .onmicrosoft.com target from a generic template — always copy the exact value from the Defender portal, since the target pattern differs depending on when your domain was added to Microsoft 365.
  • Publishing the CNAME records but never flipping DKIM to Enabled in the Defender portal.