How to check DKIM status in Exchange Online

Before you start

In the Defender portal, use a Microsoft Entra role such as Security Administrator, or a unified RBAC role with Core security settings (read). Exchange Online PowerShell follows Exchange Online roles instead, so the cmdlet may refuse an account that can open the DKIM tab.

Each method shows the configuration held in Microsoft 365, not a live DNS lookup, so a record published today can take a few minutes or longer to be detected. The examples read and export and change nothing: they do not turn signing on or rotate a key.

Option 1

Check DKIM status with PowerShell

Install the module once, then connect and export every accepted domain with its DKIM state. A domain with no signing configuration is listed as Not configured.

# Install once, if the module is not already installed.
Install-Module ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline
try {
    $configs = @{}
    foreach ($config in Get-DkimSigningConfig) { $configs[$config.Name] = $config }
    $report = @(foreach ($domain in Get-AcceptedDomain -ResultSize Unlimited) {
        $name = $domain.DomainName.ToString()
        $config = $configs[$name]
        $signing = 'Off'
        if (-not $config) { $signing = 'Not configured' }
        elseif ($config.Enabled) { $signing = 'On' }
        [pscustomobject]@{
            Domain = $name
            DomainType = $domain.DomainType
            Signing = $signing
            Status = $config.Status
            Selector1KeySize = $config.Selector1KeySize
            Selector2KeySize = $config.Selector2KeySize
            Selector1CNAME = $config.Selector1CNAME
            Selector2CNAME = $config.Selector2CNAME
            KeyCreationTime = $config.KeyCreationTime
            RotateOnDate = $config.RotateOnDate
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'No accepted domains were returned.'
    } else {
        $report | Sort-Object Domain |
            Export-Csv -Path './dkim-status.csv' -NoTypeInformation -Encoding utf8
        $notOn = @($report | Where-Object { $_.Signing -ne 'On' }).Count
        Write-Output "$($report.Count) domains exported; $notOn do not have DKIM signing on."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

The CSV has 1 row for each accepted domain. Status is Valid, CnameMissing or NoDKIMKeys, and blank where there is no configuration. Key sizes are in bits, 1024 or 2048, and KeyCreationTime is UTC. A 1024-bit key is replaced by rotating it: the first rotation to 2048 bits applies to the next active selector, and a rotation takes 4 days (96 hours).

Check a single domain

Reconnect with Connect-ExchangeOnline, then read 1 domain.

# Run while connected to Exchange Online. Replace the example domain.
Get-DkimSigningConfig -Identity 'contoso.com' |
    Format-List Name,Enabled,Status,Selector1CNAME,Selector2CNAME,KeyCreationTime,RotateOnDate

Selector1CNAME and Selector2CNAME are the 2 values the domain's DNS must hold. Copy them exactly.

Option 2

Review DKIM status in the Defender portal

1. Sign in to the Microsoft Defender portal for the correct tenant.
2. Go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings.
3. Select the DKIM tab. Each domain is listed with its Status and a Toggle that shows whether signing is enabled.
4. Select a domain's row, anywhere other than the check box beside its name or the toggle, to open its details.
5. Read Status, Last checked date and, under Publish CNAMEs, the 2 records the domain needs. Close the details without changing the toggle or choosing Rotate DKIM keys.

This suits 1 domain, or finding the CNAME values to publish. For a list you can keep and compare month to month, use PowerShell or a report.

Common questions

Why is the onmicrosoft.com domain not in the output?

Microsoft says the initial *.onmicrosoft.com domain signs outbound mail by default and usually has no entry in Get-DkimSigningConfig unless someone configured it. The script lists it as Not configured, and Altivane as On by default.

Why does Status say CnameMissing?

Microsoft 365 did not find the 2 CNAME records in DNS at its last check. Compare them with Selector1CNAME and Selector2CNAME, then wait: DNS changes can take up to 48 hours. If it still says CnameMissing after that, the records are incorrect or in the wrong DNS zone.

Why does DKIM fail after a message is forwarded?

A possible cause is an intermediary changing the message body or headers, and the fix is to configure that intermediary as a trusted ARC sealer. To see which mailboxes forward mail, see how to find mailbox forwarding in Exchange Online.