On this page

Fixing DKIM in Vodien for Microsoft 365

What this fixes

DKIM lets receiving servers verify your mail hasn't been altered in transit and really came from you. See Fixing DKIM Record Issues for what it does and why it matters.

Important: unlike most DNS-based email checks, Microsoft 365's DKIM record is a CNAME, not a TXT record — and you need two of them.

Step 1: Get your exact CNAME values from Microsoft

  1. Go to the Microsoft Defender portal (security.microsoft.com) → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM tab.
  2. Select your domain. Microsoft shows you the two CNAME records to publish.
  3. Copy the two selector names and their target values exactly as shown — the target isn't always something.onmicrosoft.com (domains added since mid-2025 get a different target pattern), so don't assume the format from a template. Copy it from the portal or via Get-DkimSigningConfig in Exchange Online PowerShell.

You'll get two records, typically named selector1._domainkey and selector2._domainkey.

Step 2: Publish both in Vodien

For each of the two records:

  1. Log in to your Vodien account.
  2. Select the domain you want to edit.
  3. Scroll to the External Editor DNS section and click Manage DNS.
  4. Scroll to the bottom of the page, click Select record type to add, and choose CNAME.
  5. Click Add.
  6. Name: the selector Microsoft gave you (e.g. selector1._domainkey).
  7. Value/Points to: the exact target Microsoft gave you.
  8. Click Update to save.
  9. Repeat for the second record.

Step 3: Turn on DKIM signing

  1. Back in the Defender portal's DKIM tab, wait for DNS to propagate, then toggle the domain to Enabled.
  2. Confirm Sign messages for this domain with DKIM signatures is on.
  3. Re-run your scan to confirm.

Common pitfalls

  • Adding these as TXT records instead of CNAME.
  • Hardcoding a .onmicrosoft.com target instead of copying the exact value from the Defender portal.
  • Publishing the CNAME records but never flipping DKIM to Enabled in the Defender portal.