Yahoo Domainkeys Verified
To Generate The Domain Key Used To Sign Mail Account
To Generate The Domain Key Used To Sign Mail Login
To Generate The Domain Key Used To Sign Mail Online
To Generate The Domain Key Used To Sign Mail Free

-->

Summary: This article describes how you use DomainKeys Identified Mail (DKIM) with Office 365 to ensure that destination email systems trust messages sent outbound from your custom domain.

Enter the domain you'd like to generate keys for, for example dkimcore.org and hit the button. Security notes. This online wizard is fine for generating keys for testing and evaluation. If you decide to use DKIM Core in production, though, you might want to consider the security risks. Domain Key / DKIM Generation Wizard. This wizard will generate the public / private 1024 bit key pair you will need to setup DomainKeys/DKIM and will give you specific instructions on how to setup Hurricane Server and your DNS server. You must specify a domain and a selector.

You should use DKIM in addition to SPF and DMARC to help prevent spoofers from sending messages that look like they are coming from your domain. DKIM lets you add a digital signature to outbound email messages in the message header. It may sound complicated, but it's really not. When you configure DKIM, you authorize your domain to associate, or sign, its name to an email message by using cryptographic authentication. Email systems that receive email from your domain can use this digital signature to help determine if incoming email that they receive is legitimate.

Basically, you use a private key to encrypt the header in your domain's outgoing email. You publish a public key to your domain's DNS records that receiving servers can then use to decode the signature. They use the public key to verify that the messages are really coming from you and not coming from someone spoofing your domain.

Office 365 automatically sets up DKIM for its initial 'onmicrosoft.com' domains. That means you don't need to do anything to set up DKIM for any initial domain names (for example, litware.onmicrosoft.com). For more information about domains, see Domains FAQ.

You can choose to do nothing about DKIM for your custom domain too. If you don't set up DKIM for your custom domain, Office 365 creates a private and public key pair, enables DKIM signing, and then configures the Office 365 default policy for your custom domain. While this is sufficient coverage for most Office 365 customers, you should manually configure DKIM for your custom domain in the following circumstances:

You have more than one custom domain in Office 365
You're going to set up DMARC too (recommended)
You want control over your private key
You want to customize your CNAME records
You want to set up DKIM keys for email originating out of a third-party domain, for example, if you use a third-party bulk mailer.

In this article:

How DKIM works better than SPF alone to prevent malicious spoofing in Office 365

SPF adds information to a message envelope but DKIM actually encrypts a signature within the message header. When you forward a message, portions of that message's envelope can be stripped away by the forwarding server. Since the digital signature stays with the email message because it's part of the email header, DKIM works even when a message has been forwarded as shown in the following example.

In this example, if you had only published an SPF TXT record for your domain, the recipient's mail server could have marked your email as spam and generated a false positive result. The addition of DKIM in this scenario reduces false positive spam reporting. Because DKIM relies on public key cryptography to authenticate and not just IP addresses, DKIM is considered a much stronger form of authentication than SPF. We recommend using both SPF and DKIM, as well as DMARC in your deployment.

The nitty gritty: DKIM uses a private key to insert an encrypted signature into the message headers. The signing domain, or outbound domain, is inserted as the value of the d= field in the header. The verifying domain, or recipient's domain, then use the d= field to look up the public key from DNS and authenticate the message. If the message is verified, the DKIM check passes.

Manually upgrade your 1024-bit keys to 2048-bit DKIM encryption keys

Yahoo Domainkeys Verified

Since both 1024 and 2048 bitness are supported for DKIM keys, these directions will tell you how to upgrade your 1024-bit key to 2048. The steps below are for two use-cases, please choose the one that best fits your configuration.

When you already have DKIM configured, you rotate bitness as follows:
1. Connect to Office 365 workloads via PowerShell. (The cmdlet comes from Exchange Online.)
2. And then execute the following cmdlet:

Rotate-DkimSigningConfig -KeySize 2048 -Identity {Guid of the existing Signing Config}

Or for a new implementation of DKIM:
1. Connect to Office 365 workloads via PowerShell. (This is an Exchange Online cmdlet.)
2. Execute the following cmdlet:

New-DkimSigningConfig -DomainName {Domain for which config is to be created} -KeySize 2048 -Enabled $True

Stay connected to Office 365 to verify the configuration.

Execute the cmdlet:

Get-DkimSigningConfig | fl

Tip

This new 2048-bit key takes effect on the RotateOnDate, and will send emails with the 1024-bit key in the interim. After four days, you can test again with the 2048-bit key (that is, once the rotation takes effect to the second selector).

If you want to rotate to the second selector, your options are a) let the Office 365 service rotate the selector and upgrade to 2048-bitness within the next 6 months, or b) after 4 days and confirming that 2048-bitness is in use, manually rotate the second selector key by using the appropriate cmdlet listed above.

Steps you need to do to manually set up DKIM in Office 365

To configure DKIM, you will complete these steps:

Publish two CNAME records for your custom domain in DNS

For each domain for which you want to add a DKIM signature in DNS, you need to publish two CNAME records.

Run the following commands to create the selector records:

To Generate The Domain Key Used To Sign Mail Account

Create CNAMEs referenced in Get-DkimSigningConfig output

Office 365 performs automatic key rotation using the two records that you establish. If you have provisioned custom domains in addition to the initial domain in Office 365, you must publish two CNAME records for each additional domain. So, if you have two domains, you must publish two additional CNAME records, and so on.

Use the following format for the CNAME records.

Important

If you are one of our GCC High customers, we calculate domainGuid differently! Instead of looking up the MX record for your initialDomain to calculate domainGuid, instead we calculate it directly from the customized domain. For example, if your customized domain is 'contoso.com' your domainGuid becomes 'contoso-com', any periods are replaced with a dash. So, regardless of what MX record your initialDomain points to, you'll always use the above method to calculate the domainGuid to use in your CNAME records.

Where:

For Office 365, the selectors will always be 'selector1' or 'selector2'.
domainGUID is the same as the domainGUID in the customized MX record for your custom domain that appears before mail.protection.outlook.com. For example, in the following MX record for the domain contoso.com, the domainGUID is contoso-com:
initialDomain is the domain that you used when you signed up for Office 365. Initial domains always end in onmicrosoft.com. For information about determining your initial domain, see Domains FAQ.

For example, if you have an initial domain of cohovineyardandwinery.onmicrosoft.com, and two custom domains cohovineyard.com and cohowinery.com, you would need to set up two CNAME records for each additional domain, for a total of four CNAME records.