Fixing Microsoft 365 DKIM 'CNAME record does not exist' Errors
Enabling DKIM signing in Microsoft 365 Defender can fail with a 'CNAME record does not exist for this config' message even when the DNS records look correct. Microsoft 365 requires two selector CNAME records in your domain's zone, each pointing to a target built from your domain and your tenant's initial .onmicrosoft.com name, so values should be copied directly from Defender rather than typed. Common causes include DNS panels appending the zone name automatically, mangled targets, a missing second selector, Cloudflare proxying instead of DNS-only records, or propagation and cached negative answers. The article recommends verifying the records with dig queries and checking message headers for dkim=pass with the correct domain, and re-testing whenever DNS changes because signing can silently break later.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)
Log in to join the discussion and vote.
Log in