How to set up DKIM for Microsoft 365.

Microsoft rotates the signing key between `selector1` and `selector2` automatically so keys don't stay static for years. At any given moment one selector is active and the other is the next-to-be-used backup. If you publish only one CNAME, every message signed with the rotated selector will fail DKIM until you publish the missing record — usually 2–4 weeks of intermittent failures before anyone notices.

`<tenant>` is your Microsoft 365 initial domain (the `*.onmicrosoft.com` name created when the tenant was provisioned, e.g. `contoso.onmicrosoft.com`). `<your-domain-with-hyphens>` is your custom domain with dots replaced by hyphens — `example.com` becomes `example-com`. The simplest way to get the exact values is to open Microsoft Defender → Email authentication settings → DKIM → select your domain → the portal shows both CNAME hostnames and targets verbatim.

Three usual causes: (1) you haven't toggled the `Sign messages for this domain with DKIM signatures` switch in the Defender portal — the records exist but Microsoft isn't signing yet; (2) DNS propagation hasn't completed for the CNAME targets (check with `dig +short CNAME selector1._domainkey.your-domain.com` from a public resolver); (3) you have a stale TXT record at the same `_domainkey` host conflicting with the CNAME. Fix the conflict, wait an hour, retry the enable button.

No — Microsoft handles DKIM for the initial `*.onmicrosoft.com` tenant domain automatically and you can't change those records. DKIM configuration is only needed for custom domains you've added to the tenant. If your `From:` address uses your custom domain, that's the domain that needs the two CNAMEs.

Run `Rotate-DkimSigningConfig -Identity your-domain.com` in Exchange Online PowerShell, or click `Rotate DKIM keys` in the Defender portal. Microsoft generates fresh 2048-bit keys behind the existing selector CNAMEs — your DNS doesn't need to change because the CNAMEs point at Microsoft-hosted key records, not the keys themselves. New rotations are limited to roughly once per week.

Use 2048-bit. Microsoft defaults new domains to 2048-bit as of late 2023; the only reason to drop to 1024-bit is a DNS provider that can't handle the longer TXT value, which is rare for the CNAME-based setup since the long key text lives on Microsoft's side. Major receivers (Gmail, Yahoo) prefer 2048-bit.