DKIM and DMARC Configuration in Microsoft 365 Print

DKIM and DMARC Configuration in Microsoft 365

DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance) are email authentication protocols designed to protect your organization’s domain from phishing and spoofing attacks. Microsoft 365 supports both, but they must be manually configured in your domain DNS panel.

🔹 DKIM Setup

1. Access the Microsoft Defender Portal

Go to the Microsoft Defender portal and follow this path:
Protection > Policies & rules > Threat policies > Email authentication > DKIM

2. Add the CNAME Records to DNS

Microsoft 365 requires two CNAME records per domain for DKIM. Here's an example structure:

• selector1._domainkey.your-domain.com → CNAME → selector1-yourdomain-com._domainkey.yourdomain.onmicrosoft.com
• selector2._domainkey.your-domain.com → CNAME → selector2-yourdomain-com._domainkey.yourdomain.onmicrosoft.com

3. Enable DKIM in Microsoft 365

After publishing the CNAME records in your DNS provider, return to the Microsoft Defender portal and click Enable DKIM.

🔹 DMARC Setup

1. Create the DMARC TXT Record

Publish the following TXT record in your domain's DNS:

_dmarc.your-domain.com    TXT    "v=DMARC1; p=none; rua=mailto:dmarc-reports@your-domain.com"

2. Parameter Overview

• v=DMARC1: Protocol version.
• p=none: No enforcement; use quarantine or reject later for stricter policy.
• rua=mailto:: Address to receive aggregate DMARC reports.

🔹 Configuration Verification

✅ DKIM Verification

Open PowerShell and run:

Get-DkimSigningConfig -Identity your-domain.com

If enabled, you will see:

Enabled          : True

✅ DMARC Verification

Open Command Prompt and run:

nslookup -type=TXT _dmarc.your-domain.com

If the record is found, the output will be:

v=DMARC1; p=none; rua=mailto:dmarc-reports@your-domain.com

📌 Conclusion and Best Practices

Implementing SPF, DKIM, and DMARC in Microsoft 365 is essential to protect your domain from spoofing and phishing. If you're just starting, use p=none to monitor traffic before enforcing stricter actions like quarantine or reject.

Need help with a specific DNS provider? Contact us for tailored support.