# DKIM Signing For Default Domain

> Enable or disable DKIM signing for the tenant’s default domain.

Enable or disable DKIM signing for the tenant’s default domain. DKIM helps ensure that outgoing mail is cryptographically signed and verifiable, protecting against spoofing and improving email deliverability.

## Settings this baseline controls

| Setting              | What it does                                                                                                                                                                 |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DKIM signing enabled | Specifies whether DKIM signing is enabled for this domain. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-dkimsigningconfig?view=exchange-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

Add this baseline to the tenant to sign outgoing mail from the tenant's default domain with DKIM, or bundle it into a scheme you deploy to many tenants at once.

1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. **Turn on DKIM signing.** Set **DKIM signing enabled** on for the tenant's default domain, so outgoing mail from that domain carries a signature receiving mail servers can verify.
3. **Publish the DKIM records first, if the default domain is a custom one.** Microsoft's `*.onmicrosoft.com` domain signs automatically. A custom domain needs its two DKIM CNAME records published in DNS before the toggle turns on; Microsoft shows the values to publish in the same place you enable signing.
4. **Save.** Turn on **Auto-remediation** ([Remediation](https://docs.octiga.io/baselines/remediation/)) if you want Octiga to turn signing back on whenever it's switched off.

## Check it worked

Passing means DKIM signing shows enabled for the tenant's default domain. You can confirm it in the Microsoft Defender portal under **Email & collaboration → Policies & rules → Threat policies → Email authentication settings**, on the **DKIM** tab, where the domain's status reads Valid rather than CnameMissing or NoDKIMKeys. End users see no difference: DKIM only changes a header on outgoing mail, which receiving mail servers check when scoring the tenant's mail.

## Standards this addresses

### CIS

- **M365 2.1.9** — CIS M365 Foundations Benchmark 2.1.9
- **v8 9.5** — CIS Controls v8 Safeguard 9.5

### NIST

- **PR.DS-4** — NIST CSF 2.0 PR.DS-4
- **SC-8** — NIST SP 800-53 SC-8
- **SC-20** — NIST SP 800-53 SC-20

### ISO 27001

- **A.8.23** — ISO/IEC 27001:2022 Annex A.8.23
- **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)