Fix guide
Publish the two DKIM records Microsoft gives you and switch on signing for your domain.
A Microsoft 365 admin account with access to the Defender portal, and access to your domain’s DNS. Add the SPF record for Microsoft 365 at the same time.
Open the Defender portal. Go to security.microsoft.com, then Email & collaboration › Policies & rules › Threat policies › Email authentication settings, and open the DKIM tab.
Select your domain. Microsoft shows two CNAME records, for selector1._domainkey and selector2._domainkey.
Add both CNAME records at your DNS provider. Copy the names and the values exactly. They are CNAMEs, not TXT records.
Switch signing on. Once DNS has updated, return to the DKIM tab and turn on “Sign messages for this domain with DKIM signatures”.
Microsoft rotates between the two keys so it can replace one without breaking signing. Keep both records in place permanently.
Check it worked
Enter your domain. The checker tries selector1 and selector2 first for Microsoft 365 domains.
