Set up DKIM to sign mail from your cloud domain

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. Next steps “DKIM alone isn't enough to prevent spoofing of your Microsoft 365 domain. You also need to configure SPF and DMARC for the best possible protection.” Set up SPF to identify valid email sources for your custom cloud domains

   In Email authentication

2. Important facts about DKIM: “The domain that's used to DKIM sign the message isn't required to match the domain in the MAIL FROM or From addresses in the message.” A message can have multiple DKIM signatures by different domains. In fact, many hosted email services sign the message using the service domain, and then sign the message again using the customer domain after the customer configures DKIM signing for the domain.

   In Authentication alignment

3. “DomainKeys Identified Mail (DKIM) is a method of email authentication that helps validate mail sent from your Microsoft 365 organization to prevent spoofed senders that are used in business email compromise (BEC), ransomware, and other phishing attacks.” The primary purpose of DKIM is to verify that a message wasn't altered in transit. Specifically:

   In DKIM signing

4. DomainKeys Identified Mail (DKIM) is a method of email authentication that helps validate mail sent from your Microsoft 365 organization to prevent spoofed senders that are used in business email compromise (BEC), ransomware, and other phishing attacks. “The primary purpose of DKIM is to verify that a message wasn't altered in transit.” One or more private keys are generated for a domain and are used by the source email system to digitally sign important parts of outbound messages. These message parts include: From, To, Subject, MIME-Version, Content-Type, Date, and other message header fields (depending on the source email system). The message body.

   In DKIM signing

5. One or more private keys are generated for a domain and are used by the source email system to digitally sign important parts of outbound messages. These message parts include: From, To, Subject, MIME-Version, Content-Type, Date, and other message header fields (depending on the source email system). The message body. “The digital signature is stored in the DKIM-Signature header field in the message header and remains valid as long as intermediate email systems don't modify the signed parts of the message.” The corresponding public keys are stored in DNS records for the signing domain (CNAME records in Microsoft 365; other email systems might use TXT records).

   In DKIM signing

6. The primary purpose of DKIM is to verify that a message wasn't altered in transit. Specifically: “One or more private keys are generated for a domain and are used by the source email system to digitally sign important parts of outbound messages.” The digital signature is stored in the DKIM-Signature header field in the message header and remains valid as long as intermediate email systems don't modify the signed parts of the message. The signing domain is identified by the d= value in the DKIM-Signature header field.

   In DKIM signing

7. The primary purpose of DKIM is to verify that a message wasn't altered in transit. Specifically: “From, To, Subject, MIME-Version, Content-Type, Date, and other message header fields (depending on the source email system).” The digital signature is stored in the DKIM-Signature header field in the message header and remains valid as long as intermediate email systems don't modify the signed parts of the message. The signing domain is identified by the d= value in the DKIM-Signature header field.

   In DKIM signing

8. The digital signature is stored in the DKIM-Signature header field in the message header and remains valid as long as intermediate email systems don't modify the signed parts of the message. The signing domain is identified by the d= value in the DKIM-Signature header field. “The corresponding public keys are stored in DNS records for the signing domain (CNAME records in Microsoft 365; other email systems might use TXT records).” Destination email systems use the d= value in the DKIM-Signature header field to: Identify the signing domain. Look up the public key in the DKIM DNS record for the domain. Use the public key in the DKIM DNS record for the domain to verify the message signature.

   In DKIM signing

9. One or more private keys are generated for a domain and are used by the source email system to digitally sign important parts of outbound messages. These message parts include: From, To, Subject, MIME-Version, Content-Type, Date, and other message header fields (depending on the source email system). The message body. “The signing domain is identified by the d= value in the DKIM-Signature header field.” The corresponding public keys are stored in DNS records for the signing domain (CNAME records in Microsoft 365; other email systems might use TXT records).

   In DKIM signing

Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.