DKIM Signing For Default Domain
Enable or disable DKIM signing for the tenant’s default domain. DKIM helps ensure that outgoing mail is cryptographically signed and verifiable, protecting against spoofing and improving email deliverability.
Settings this baseline controls
| Setting | What it does |
|---|---|
| DKIM signing enabled | Specifies whether DKIM signing is enabled for this domain. Learn more |
Configure it
Add this baseline to the tenant to sign outgoing mail from the tenant’s default domain with DKIM, or bundle it into a scheme you deploy to many tenants at once.
-
Add the baseline.
Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).
-
Turn on DKIM signing.
Set DKIM signing enabled on for the tenant’s default domain, so outgoing mail from that domain carries a signature receiving mail servers can verify.
-
Publish the DKIM records first, if the default domain is a custom one.
Microsoft’s
*.onmicrosoft.comdomain signs automatically. A custom domain needs its two DKIM CNAME records published in DNS before the toggle turns on; Microsoft shows the values to publish in the same place you enable signing. -
Save.
Turn on Auto-remediation (Remediation) if you want Octiga to turn signing back on whenever it’s switched off.
Check it worked
Passing means DKIM signing shows enabled for the tenant’s default domain. You can confirm it in the Microsoft Defender portal under Email & collaboration → Policies & rules → Threat policies → Email authentication settings, on the DKIM tab, where the domain’s status reads Valid rather than CnameMissing or NoDKIMKeys. End users see no difference: DKIM only changes a header on outgoing mail, which receiving mail servers check when scoring the tenant’s mail.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.