This posts walks through the steps to use DomainKeys Identified Mail (DKIM) with Microsoft 365 to ensure that destination email systems trust messages sent outbound from your custom domain. Microsoft 365 automatically sets up DKIM for its initial ‘onmicrosoft.com’ domains. That means you don’t need to do anything to set up DKIM for any initial domain names (for example, contoso.onmicrosoft.com). I’m going to use contoso.onmicrosoft.com as our tenant domain. Since we actually own contoso.com, we need to add it to our domains in 365. You can add domains here. Once that is provisioned we need to add two CNAME records so that contoso.com points to contoso.onmicrosoft.com.
Below is an example of what the two CNAME records should reflect:
Host name: selector1._domainkey
Points to address or value: selector1-contoso-com._domainkey.tenantdomain.onmicrosoft.com
TTL: 3600
Host name: selector2._domainkey
Points to address or value: selector2-contoso-com._domainkey.tenantdomain.onmicrosoft.com
TTL: 3600
Once the two CNAME records are created, we can continue to enable DKIM for your custom domain. Click here to open the DKIM settings for your environment. You can navigate there manually by going to https://security.microsoft.com and signing in with an administrator account. From the main page, click on Policies & rules>Threat policies>DKIM.
Click on the domain you wish to configure DKIM on the DKIM page and click on the switch to change to Enabled. After a few minutes, you can test that everything was configured correctly.
A few tools you can use are listed below:
Manny Tips 