Microsoft 365 DKIM uses two CNAME records, selector1._domainkey and selector2._domainkey, pointing to your tenant’s *.onmicrosoft.com keys. Publish both CNAMEs, then enable DKIM signing for the domain in the Microsoft Defender portal.
Microsoft provides two CNAMEs that point to selector1-…_domainkey.<tenant>.onmicrosoft.com and the selector2 equivalent. Add both to your DNS.
In the Defender portal → Email & collaboration → Policies → Email authentication settings → DKIM, select your domain and switch “Sign messages for this domain with DKIM signatures” to On.
It’s a CNAME:
$ dig CNAME selector1._domainkey.yourdomain.com +shortCheck your DKIM record now
Open the free DKIM checker →Most often because signing wasn’t enabled in the Defender portal, or the CNAMEs haven’t propagated. Both selectors must resolve and signing must be On.
