On this page

Fixing DKIM in SiteGround for Microsoft 365

What this fixes

DKIM lets receiving servers verify your mail hasn't been altered in transit and really came from you. See Fixing DKIM Record Issues for what it does and why it matters.

Important: unlike most DNS-based email checks, Microsoft 365's DKIM record is a CNAME, not a TXT record — and you need two of them.

This assumes your domain's DNS is managed through SiteGround's DNS Zone Editor (i.e. SiteGround's nameservers are set at your registrar).

Step 1: Get your exact CNAME values from Microsoft

  1. Go to the Microsoft Defender portal (security.microsoft.com) → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM tab.
  2. Select your domain. Microsoft shows you the two CNAME records to publish.
  3. Copy the two selector names and their target values exactly as shown — the target format varies by when your domain was added, so copy it directly rather than guessing the pattern.

You'll get two records, typically named selector1._domainkey and selector2._domainkey.

Step 2: Publish both in SiteGround

For each of the two records:

  1. Log in to Site Tools.
  2. Go to Domain → DNS Zone Editor.
  3. Under Record Type, select CNAME.
  4. Name: the selector Microsoft gave you (e.g. selector1._domainkey).
  5. Value: the exact target Microsoft gave you.
  6. Click Create.
  7. Repeat for the second record.

Step 3: Turn on DKIM signing

  1. Back in the Defender portal's DKIM tab, wait for DNS to propagate, then toggle the domain to Enabled.
  2. Confirm Sign messages for this domain with DKIM signatures is on.
  3. Re-run your scan to confirm.

Common pitfalls

  • Adding these as TXT records instead of CNAME.
  • Hardcoding a .onmicrosoft.com target instead of copying the exact value from the Defender portal.
  • Assuming SiteGround manages your DNS by default — if your domain was registered elsewhere and only points its nameservers to SiteGround for hosting, this change may need to happen at that other provider instead.