Article
Set up DKIM to sign mail from your cloud domain
learn.microsoft.com
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
Important facts about DKIM: “The domain that's used to DKIM sign the message isn't required to match the domain in the MAIL FROM or From addresses in the message.” A message can have multiple DKIM signatures by different domains. In fact, many hosted email services sign the message using the service domain, and then sign the message again using the customer domain after the customer configures DKIM signing for the domain.
“DomainKeys Identified Mail (DKIM) is a method of email authentication that helps validate mail sent from your Microsoft 365 organization to prevent spoofed senders that are used in business email compromise (BEC), ransomware, and other phishing attacks.” The primary purpose of DKIM is to verify that a message wasn't altered in transit. Specifically:
In DKIM signing
DomainKeys Identified Mail (DKIM) is a method of email authentication that helps validate mail sent from your Microsoft 365 organization to prevent spoofed senders that are used in business email compromise (BEC), ransomware, and other phishing attacks. “The primary purpose of DKIM is to verify that a message wasn't altered in transit.” One or more private keys are generated for a domain and are used by the source email system to digitally sign important parts of outbound messages. These message parts include: From, To, Subject, MIME-Version, Content-Type, Date, and other message header fields (depending on the source email system). The message body.
In DKIM signing
One or more private keys are generated for a domain and are used by the source email system to digitally sign important parts of outbound messages. These message parts include: From, To, Subject, MIME-Version, Content-Type, Date, and other message header fields (depending on the source email system). The message body. “The digital signature is stored in the DKIM-Signature header field in the message header and remains valid as long as intermediate email systems don't modify the signed parts of the message.” The corresponding public keys are stored in DNS records for the signing domain (CNAME records in Microsoft 365; other email systems might use TXT records).
In DKIM signing
The primary purpose of DKIM is to verify that a message wasn't altered in transit. Specifically: “One or more private keys are generated for a domain and are used by the source email system to digitally sign important parts of outbound messages.” The digital signature is stored in the DKIM-Signature header field in the message header and remains valid as long as intermediate email systems don't modify the signed parts of the message. The signing domain is identified by the d= value in the DKIM-Signature header field.
In DKIM signing
The primary purpose of DKIM is to verify that a message wasn't altered in transit. Specifically: “From, To, Subject, MIME-Version, Content-Type, Date, and other message header fields (depending on the source email system).” The digital signature is stored in the DKIM-Signature header field in the message header and remains valid as long as intermediate email systems don't modify the signed parts of the message. The signing domain is identified by the d= value in the DKIM-Signature header field.
In DKIM signing
The digital signature is stored in the DKIM-Signature header field in the message header and remains valid as long as intermediate email systems don't modify the signed parts of the message. The signing domain is identified by the d= value in the DKIM-Signature header field. “The corresponding public keys are stored in DNS records for the signing domain (CNAME records in Microsoft 365; other email systems might use TXT records).” Destination email systems use the d= value in the DKIM-Signature header field to: Identify the signing domain. Look up the public key in the DKIM DNS record for the domain. Use the public key in the DKIM DNS record for the domain to verify the message signature.
In DKIM signing
One or more private keys are generated for a domain and are used by the source email system to digitally sign important parts of outbound messages. These message parts include: From, To, Subject, MIME-Version, Content-Type, Date, and other message header fields (depending on the source email system). The message body. “The signing domain is identified by the d= value in the DKIM-Signature header field.” The corresponding public keys are stored in DNS records for the signing domain (CNAME records in Microsoft 365; other email systems might use TXT records).
In DKIM signing
“DomainKeys Identified Mail (DKIM) is a method of email authentication that helps validate mail sent from your Microsoft 365 organization to prevent spoofed senders that are used in business email compromise (BEC), ransomware, and other phishing attacks.” The primary purpose of DKIM is to verify that a message wasn't altered in transit. Specifically:
The corresponding public keys are stored in DNS records for the signing domain (CNAME records in Microsoft 365; other email systems might use TXT records). “Use the public key in the DKIM DNS record for the domain to verify the message signature.” Important facts about DKIM:
Next steps “DKIM alone isn't enough to prevent spoofing of your Microsoft 365 domain. You also need to configure SPF and DMARC for the best possible protection.” Set up SPF to identify valid email sources for your custom cloud domains
Tip “We recommend using subdomains for email systems or services you don't directly control, so issues with those services don't affect your main domain's reputation.” For example, your email domain in Microsoft 365 is contoso.com, and you use the Adatum bulk mailing service for marketing email. If Adatum supports DKIM signing of messages from senders in your domain at their service, the messages might contain the following elements: