Turn on DKIM in Microsoft 365 or Google Workspace

The short version

• DKIM is switched on inside the service that sends your mail. DNS only holds the public key.
• Microsoft 365: Defender portal, Email authentication settings, DKIM tab. Publish two CNAME records, then turn on Sign messages for this domain with DKIM signatures.
• Google Workspace: Admin console, Apps, Google Workspace, Gmail, Authenticate email. Generate a 2048-bit key, publish the TXT record, then click Start authentication.
• Test by sending to an outside Gmail address and checking for DKIM: PASS.
• Repeat for every other tool that sends as your domain.

How do I set up DKIM in Microsoft 365?

These steps follow Microsoft’s DKIM page, checked on October 31, 2026. You need an admin role that can manage security settings.

1. Sign in to the Microsoft Defender portal at security.microsoft.com.
2. Go to Email & collaboration, then Policies & rules, then Threat policies, then Email authentication settings.
3. Select the DKIM tab and find your domain. Its Toggle shows Disabled.
4. Try to slide the toggle to Enabled. A Client error box appears with the record values. Select OK. The domain’s status now reads CnameMissing.
5. Select the domain’s row (not the toggle) to open its details. Under Publish CNAMEs, copy the two records.
6. At your DNS provider, create two CNAME records:
   • Host selector1._domainkey, pointing to the selector1 value Microsoft shows.
   • Host selector2._domainkey, pointing to the selector2 value.
7. Wait a few minutes, or longer, for Microsoft to see them. Then go back to the open details panel and turn on Sign messages for this domain with DKIM signatures.
8. The status changes to Valid once signing is on.

What will the records look like?

Microsoft changed the format for new custom domains in May 2025. Domains added since then point to a name ending in dkim.mail.microsoft, for example selector1-yourbusiness-com._domainkey.yourtenant.r-v1.dkim.mail.microsoft (an example). Older domains keep the earlier format ending in onmicrosoft.com. Both are correct. Copy exactly what your portal shows rather than building the value by hand.

Mail sent from your tenant’s own onmicrosoft.com address is signed automatically. That signature doesn’t help your own domain, so the steps above still matter.

How do I set up DKIM in Google Workspace?

These steps follow Google’s DKIM page. You need super administrator access. Google says to wait 24 to 72 hours after first turning on Gmail before generating a key.

1. In the Google Admin console, go to Menu, then Apps, then Google Workspace, then Gmail, and click Authenticate email.
2. In Selected domain, choose your domain.
3. Click Generate New Record. Choose 2048 for key length, unless your DNS provider can’t handle it, and keep the default prefix selector, google.
4. Click Generate, then copy the DNS Host name and the TXT record value. Don’t click Start authentication yet.
5. At your DNS provider, add a TXT record with host google._domainkey and the long value Google gave you, which starts v=DKIM1; k=rsa; p=.
6. Wait for it to take effect. Google says up to 48 hours.
7. Go back to Authenticate email, select the domain and click Start authentication. The status should change to Authenticating email with DKIM.

Google notes the page may say “You must update the DNS records for this domain” for up to 48 hours even when the record is right.

How do I know it’s working?

Send a message from your business mailbox to a personal Gmail address. Google says sending to yourself doesn’t prove anything. In Gmail, open the message, select the three-dot menu, then Show original. Look for DKIM: 'PASS' with your own domain, not onmicrosoft.com or a provider’s domain. The Authentication-Results header shows the same thing in any mail program.

Why does DKIM matter?

DKIM is a signature that can survive forwarding, which SPF usually doesn’t. It stays valid only while the signed parts of the message are unchanged, so a forwarder or mailing list that edits the subject or adds a footer can break it, as Microsoft’s DKIM page notes. It’s also how most newsletter and CRM tools prove they send for you without adding to your SPF record. And it’s usually the check that makes DMARC pass. Gmail’s sender guidelines require SPF or DKIM from everyone, and both from bulk senders. For the ideas behind all three records, read our article on SPF, DKIM and DMARC explained.

What are the common mistakes?

• Publishing the records and never switching signing on. It’s a common one. Microsoft’s toggle and Google’s Start authentication button are separate steps.
• The domain added twice to the host name. Some DNS providers add your domain automatically. If you type selector1._domainkey.yourbusiness.com, you can end up with .yourbusiness.com.yourbusiness.com.
• A TXT value cut short. A 2048-bit Google key is long. Some providers limit how long one TXT string can be; Google’s troubleshooting page explains splitting it or using a 1024-bit key.
• Proxying the CNAMEs. On Cloudflare, set DKIM CNAME records to DNS only. Cloudflare’s proxy status page says records used for email shouldn’t be proxied.
• Forgetting other senders. Your newsletter tool, CRM and website sending service each need their own DKIM setup. Their selectors are different, so they don’t clash.
• Publishing DKIM on unused domains. Microsoft advises against it for parked domains. No key means forged mail can’t pass.

What if it still doesn’t pass?

• Status stuck on CnameMissing (Microsoft): check the host names and values character by character, wait longer, then try the toggle again.
• “DKIM record was not created” (Google): you probably generated the key too soon after setting up Gmail. Wait and generate a new one.
• DKIM passes but shows the wrong domain: signing is happening with the provider’s default domain, not yours. Signing for your domain isn’t turned on yet.
• An outbound gateway or archiving service that changes messages after signing can break DKIM. Google’s page mentions this.

How long does it take?

About 15 minutes of clicking, then up to 48 hours of waiting for DNS. It’s free; both providers include DKIM. Microsoft can also rotate keys later, and a rotation takes four days to come into use.

How does E-3 handle this?

DKIM is one of the records we look at first when a client’s mail lands in spam, alongside SPF and DMARC. In one case in our records, bulk mail from a Google Workspace domain kept landing in spam until a 2048-bit Google DKIM key and a DMARC record were added. If you’re not sure whether yours is on, our email deliverability checker is a quick place to start.

Related questions

• What SPF record do I need for Microsoft 365 or Google Workspace?
• How do I move DMARC from none to reject safely?
• How do I add newsletter and CRM tools without breaking SPF?
• What does DKIM mean?
• Back to the complete guide to business email that lands

Sources

1. How to use DKIM for email in your custom domain (Microsoft Learn)
2. Set up DKIM (Google Workspace Admin Help)
3. Proxy status (Cloudflare DNS docs)
4. Troubleshoot DKIM issues (Google Workspace Admin Help)