Last week one of the known load balancer company send me an email where sender and recipient email address were my domain’s email addresses on my office 3 65. In the post incident RCA Microsoft told that SPF is not enough for this incident and we should have DKIM enabled for our domains.

Microsoft recommends to create DKIM DNS record along with SPF which adds the digital signature. Check Microsoft TechNet Blog here to learn more.

Public Key Example

Overall it is a 2 step process. First is the creation of 2 CNAME records and second is Enabling DKIM in office 365 which will create 2 DKIM TXT record. The key here is learning how to create Cname record.

Mar 16, 2016  To do this, you need to setup DKIM (DomainKeys Identified Mail). On the plus side, the setup is actually pretty simple: Go to dkimcore.org, and create a public/private key pair. Just enter your domain, and press the “Generate” button. In a few moments, you’ll get a key pair. Keep this page open or saved, so you can grab the public key later. Generating 2048 bit DKIM key. Please note that you may want to use a 2048 bit DKIM key - in this case, use the following openssl commands: openssl genrsa -out private.key 2048 openssl rsa -in private.key -pubout -out public.key However, 2048 bit public DKIM key is too long to fit into one single TXT record - which can be up to 255 characters. Apr 03, 2019  Email verification and authentication are the core purposes that DKIM solves and gives spam-free user-friendly communication services to the sender and recipient of the email. Let us understand how to set up DKIM in your DNS system. Steps to set up DKIM: You can generate your Domain key after 24 hours of the activation of your Gmail account.

I am sharing the following steps to enable DKIM record in Office 365.

  • Create 2 CNAME record else you will see the below warning:

    CNAME record does not exist for this config. Please publish the following two CNAME records first.

    selector1-emaildomainname._domainkey.Tenantename.onmicrosoft.com

    selector2-emaildomainname._domainkey.Tenantename.onmicrosoft.com


  • Login to your office 365 tenant
  • Open the Exchange Admin Center à Protection à DKIM à Select the domain and click Enable


Or

  • Click on Security Policies à DKIM à Select the domain and click Enable


Generate Dkim Public Key Hostgator Login


We do not need to rotate the Key. Microsoft does it for us.

For the verification, I had sent an email to MSExchangeGuru.com email address and the successful DKIM validation.


This is how my previous email used to look like.


Even though my sender domain is not onmirosoft.com, it used to pick up our tenant domain. This means it was using the default signature created by Microsoft but it is not 100 secure so you should configure DKIM for your domain.

How To Verify Dkim Key

Now the question is where are my DKIM record. It is simple logic. We created 2 Cname record which are the alias records so it will go to the pointers under Tenantename.onmicrosoft.com which is owned by Microsoft so you can’t see it in your DNS provider list.

There are couple of ways to check them

  • Login to your office 365 à Settings à Domains à Select your domain à Additional Office 365 records.


Or

  • Open command prompt à Nslookupà Set q=txtà Then type the pointer and enter


  • We can also test the DKIM record working here. http://dkimcore.org/tools/keycheck.html

Just fill like this and click check


YAY! This is a valid DKIM key record

Dkim


We are done DKIM for Office 365 here. I know some of you will ask to provide a blog for on premise, expect it sooner.

I am also sharing couple of reference here.

Generate Dkim Public Key Hostgator Access

How anti spoofing protection works in Office 365 Mail http://aka.ms/AntiSpoofingInOffice365

https://blogs.msdn.microsoft.com/tzink/2016/03/07/a-powershell-script-to-help-you-validate-your-dkim-config-in-office-365/

Prabhat Nigam

Microsoft MVP CTO @ Golden Five

[email protected]


Coments are closed
Scroll to top