Free tools · Email domain setup
Microsoft 365 DKIM: CNAME and Selector Guide
Microsoft 365 provides two DKIM CNAME records for a custom domain. Their target values depend on the tenant and configuration. Retrieve those exact values from Microsoft before editing DNS.
Real public DNS lookup. No signup, mailbox connection or API key needed.
Check your published DKIM record
Enter your own public domain and actual selector. The illustrated examples below are not preloaded and no lookup runs until you submit.
Look up your public DKIM record.
Enter your domain and its DKIM selector to see the published record and any issues found. Results appear here after a real DNS lookup.
What to do next
1. Open the domain's DKIM configuration
Use the DKIM tab in Microsoft Defender's Email authentication settings, or the documented Exchange Online PowerShell command, to view the custom domain's required records.
2. Copy both exact CNAME targets
Publish Microsoft's supplied values for selector1._domainkey and selector2._domainkey at your DNS host. Do not manufacture a target from an old onmicrosoft.com example.
3. Enable signing after record detection
Follow Microsoft's domain-specific setup steps and check its enabled/status result. Publishing a CNAME alone does not establish that outbound messages are being signed.
4. Inspect the active message selector
Read s= and d= from a recent received message, then check that exact pair below. DNS delegation can lead to a provider-hosted key; a lookup failure or missing key is not a cryptographic verdict about all your messages.
Record names and tenant-provided targets
selector1._domainkey.example.com → [copy Selector1CNAME from Microsoft] selector2._domainkey.example.com → [copy Selector2CNAME from Microsoft]
This is an instructional map for a fictional domain. The target placeholders are not records to publish. Microsoft's current guidance includes a newer target format for some domains and an older format for existing configurations.
Use the values your tenant displays
Microsoft's newer format can include an assigned partition component. The expected value is the one returned for your domain, not a target reconstructed from an article's example.
Two selectors support rotation
Microsoft provisions a pair of selectors and rotates which key signs messages. Check the signature's active selector and keep the provider-required records in place.
Questions
Should I paste the full CNAME into the selector field?
No. Enter the s= selector from the message, such as selector1 when that is the actual value, and its d= signing domain in the separate domain field.
Does this page change my Microsoft account?
No. It makes a public DNS lookup for your inputs and reports the result. Tenant configuration and DNS changes remain with your administrators.
Checking sends your public domain and selector to AskQuokka. Record generation and copying run in this tab. No DNS settings are changed and no email is sent. Domain inputs and lookup results are not included in tool analytics.
Official references
References checked 23 October 2026. Use your provider's current domain-specific values.
More setup and troubleshooting guides
How to Find Your DKIM Selector
Find the s= selector and d= signing domain in a DKIM-Signature header, then look up that exact public key with the free checker.
Google Workspace DKIM Setup and Selector Check
Review Google Workspace DKIM setup, publish the Admin console's public key and check the actual selector. No Google connection is needed for DNS checks.