How to Enable DKIM in Microsoft 365?

Do you think the outbound messages from your domain are always trusted? What if someone spoofs your domain identity? Yes, spoofing is falsifying one’s original identity to obtain credentials from users and access confidential information. Hence to protect organizations from domain spoofing, Microsoft uses some email authentication methods to verify the emails in transit.   

SPF, DKIM, and DMARC are the trio of email authentication methods in Exchange Online protection for safeguarding the domain from being phished or spoofed. Among the three methods of email validation, Domain Keys Identified Mail (DKIM) plays a key role as it prevents forged emails by using a digital signature.  

Most business organizations prefer setting the DKIM method since it lets you sign all emails with an encrypted digital signature. It notifies the receiving server that the email is from an authorized domain and significantly reduces the false positives in spam reporting. 

So, without further delay, let’s know what DKIM is and how to enable them to secure your domain.

Exchange Online Email Authentication Methods    

Exchange Online Protection uses SPF, DKIM, and DMARC to protect organizations against email spoofing and phishing attacks. For the default Microsoft domains, the SPF and DKIM email validation methods are enabled by default. But, in the case of custom domains, these listed email validation methods have to be manually enabled under certain conditions, even though Microsoft handles DKIM configuration for them.  

• Sender Policy Framework (SPF) – This framework validates IP addresses based on SPF TXT records. 
• Domain Keys Identified Mail (DKIM) – This method uses private keys to encrypt the outbound emails with a digital signature and public keys to decrypt and authenticate the received email.  
• Domain-based Message Authentication, Reporting, and Conformance (DMARC) -This method will check for both SPF and DKIM alignment. For SPF alignment, it compares the ‘From’ address with the ‘Mail From’ field. For DKIM alignment, it compares the domain in the ‘d’ tag with the ‘Mail From’ field. Remember that DMARC is not enabled by default for .onmicrosoft domains. 

As of now, we are clear with the required methods to prevent your domain from getting spoofed. However, many organizations prefer DKIM as it encrypts emails with a digital signature and retains domain reputation against intra-organizational & cross-domain spoofing. Thus, let us delve deep into DKIM and its configuration methods. 

Microsoft 365 Domain Keys Identified Mail (DKIM)  

DKIM authentication method is used to validate outbound email messages through digital signatures. Once the DKIM configuration is successful, a digital signature is added to the message header. Later, the receiving server verifies the signature to authenticate the sender’s domain. 

This cryptographic authentication method uses a private key to encrypt the header and body content of the outbound email. Then, the receiving servers use a public key established in the domains’ DNS records for decrypting the header and body content of email messages. 

Although Microsoft provides DKIM setup for all Microsoft (.onmicrosoft.com) and custom domains by default, sometimes DKIM must be enabled and handled by respective organizations to take control of your email authentication when you have multiple custom domains. 

License Requirements for Microsoft 365 DKIM Configuration  

Now easily enable DKIM in your Microsoft 365 with the following add-on licenses. 

• Microsoft 365 Defender for Office 365 Plan 1 and Plan 2  
• Microsoft 365 Defender  

However, these licenses are available by default in basic subscriptions such as Microsoft 365 Business Basic, Microsoft 365 Business Standard, and Microsoft 365 Business Premium. 

Why Should DKIM be Enabled for Custom Domains in Microsoft 365? 

As discussed earlier, though Microsoft also handles DKIM for custom domains, it has to be enabled manually under certain situations which are listed below. 

• When you have one or more custom domains. 
• If you are about to set up DMARC. 
• If you want to take control of your private key. 
• In case, you need to customize CNAME records. 
• When you use a third-party domain to send emails. 

Thus, these are the various reasons why Microsoft asks organizations to handle DKIM for better validation and reputation among email services.  

How to Enable DKIM in Microsoft 365? 

Now, enable DKIM in any of the following ways to build a good domain reputation in your Microsoft 365 environment. 

1.  Enable DKIM in Microsoft 365 Defender Portal.   
2.  Configure DKIM in Microsoft 365 Using PowerShell.    

Enable DKIM in Microsoft 365 Defender Portal 

Are you struggling with how to enable DKIM in your Microsoft 365 space? Drop your worries! Here are our comprehensive steps to enable it in Microsoft 365 Defender portal.  

1. First and foremost, navigate to the path below to find the DKIM page. 

Microsoft 365 Defender 🡢 Email & Collaboration 🡢Policies & rules 🡢Threat policies 🡢Rules 🡢Email authentication settings 🡢DKIM 

2. Now select the desired domain, and you will see a flyout saying the status is “No DKIM keys saved for this domain” if you are configuring DKIM for the first time. 

3. Then, select the Create DKIM keys button at the bottom of the page to get the selector records. 

4. Clicking on the Create DKIM keys button, publishes the CNAME records in a pop-up window. 

5. Copy the CNAME records and paste them to your domain’s DNS. 

6. After pasting, now come back to the DKIM page for further settings. 

7. Now, slide the “Sign messages for this domain with DKIM signatures” toggle bar from the Disabled to Enabled state in the fly-out. 

8. If you face an error message stating “CNAME record doesn’t exist”, wait for the synchronization to occur for a few hours or otherwise check for any human errors while copy-pasting the records.  

9. Try to repeat the process patiently without any errors in case the problem persists. 

Since we have seen how to enable DKIM in the Defender portal, let us now look at how to configure it using PowerShell manually. 

Configure DKIM in Microsoft 365 Using PowerShell 

Configuring Microsoft 365 DKIM using PowerShell can be carried out with the following steps.  

1. Connect to the Exchange Online PowerShell module.  

2. Most importantly, establish two CNAME records for every additional custom domain you have. Thus, you can easily add DKIM signatures for them.  

3. Usually, DKIM selectors denote the specific location of the public key for the receiving servers to identify the public key location. Thus, create the selector records for additional domains by executing the following cmdlets.  

Get-DkimSigningConfig -Identity <domain> | Format-List Selector1CNAME, Selector2CNAME  

Also, note that you should manually enter the DKIM selectors for this case.   

4. Next, paste the established CNAME records into your domain’s DNS. Although the second record points to an address that does not exist, it is used for seamless DKIM key rotation.  

NOTE: If you encounter an error saying “No DKIM keys saved for this domain”, then run the following cmdlet to enable DKIM signing after replacing your domain name in the cmdlet. 

Set-DkimSigningConfig -Identity <Domain> -Enabled $true 

DKIM Key Rotation in Microsoft 365 

Microsoft 365 DKIM key rotation is the process of creating a new pair of public and private keys to authenticate email messages and secure their domain identity. One must rotate DKIM keys in Microsoft 365 for every six months to prevent them from getting compromised. Let’s see how to rotate DKIM keys in Microsoft 365.  

Rotate DKIM Keys in Microsoft 365 Defender Portal: 

Navigate to the DKIM page in the Defender portal and rotate DKIM encryption keys by clicking the “Rotate DKIM keys” button. 

Rotate DKIM Keys Using PowerShell: 

Run the following commands to rotate DKIM key bitness in Microsoft 365 after configuring DKIM. 

Rotate-DkimSigningConfig -KeySize 2048 -Identity <DkimSigningConfigIdParameter> 

Verify DKIM Configuration in Microsoft 365 

Now you can verify the DKIM configuration by sending email messages from your custom domain to Outlook.com or Hotmail.com. You can also verify DKIM by viewing the message headers in Outlook. But don’t conduct your DKIM verification with aol.com since it skips DKIM validation if the SPF validation is successful.   

How to Disable DKIM in Microsoft 365? 

If you disable DKIM for a custom domain, it will not be completely disabled. Since Microsoft will use a default policy to create and enable DKIM for that particular custom domain, it will automatically turn the DKIM into an enabled state. Thus, to disable DKIM in your Microsoft 365, one has to disable DKIM on both custom and default domains. So, let us discuss the steps to disable DKIM in Office 365 under this section. 

1. Disable DKIM in Microsoft 365 Defender portal by navigating through the following path. 

Microsoft 365 Defender 🡢 Email & Collaboration 🡢Policies & rules 🡢Threat policies 🡢Rules 🡢Email authentication settings 🡢DKIM 

2. Select the desired domain from the DKIM page. 

3. Change the Enabled toggle bar to Disabled for the desired domain.