Microsoft 365 DKIM: "CNAME record does not exist for this config" and how to fix it

Defender informs you that the CNAME record for your DKIM configuration does not exist, despite the records appearing correct in your DNS panel. Microsoft 365 employs two selectors, each requiring a CNAME in your zone: selector1._domainkey.example.com CNAME selector1-example-com._domainkey.tenant.onmicrosoft.com, and selector2._domainkey.example.com CNAME selector2-example-com._domainkey.tenant.onmicrosoft.com.

Copy these values from Defender rather than typing them. A single character error will prevent the toggle from enabling. Common causes include the DNS host appending your domain automatically, the target being mangled due to trailing dots or lowercase issues, and only one selector existing. Ensure both selectors resolve properly and that proxying or flattening is not altering the CNAME target.

Propagation and caching can also delay the process. Verify using dig +short CNAME commands, and after confirming the records, enable signing in Defender and send a test message to an external mailbox. Look for dkim=pass header.d=example.com in the message headers. If it shows header.d=yourtenant.onmicrosoft.com, signing is active but not aligned with your From domain, which will impact DMARC enforcement.

Remember, DKIM requires ongoing maintenance, and key rotation or DNS migrations can break signing without warning. Periodically check the dig commands and review message headers whenever DNS changes or on a regular schedule.