Known quirk
Microsoft 365 doesn't sign with your domain until you turn DKIM on
Microsoft 365 signs mail with its own onmicrosoft.com domain by default. For DMARC, mail has to be signed with your domain, and that's a switch you turn on.
What this means for you
- This is a real step to take: turn on DKIM for your domain in Microsoft 365.
- Mail may already show a passing DKIM signature, but it's Microsoft's domain, not yours, so it doesn't help DMARC.
Why it happens
DKIM proves who signed a message. Microsoft 365 automatically signs with your tenant's onmicrosoft.com domain, which isn't the domain people see. Signing with your own domain needs two CNAME records and DKIM turned on for that domain.
Technical detail
Outbound mail is DKIM signed with the initial *.onmicrosoft.com domain unless DKIM signing is configured for the custom domain. A message needs to be DKIM signed by the domain in the From address to align. Enable it in the Defender portal (Email authentication settings, DKIM) after publishing selector1 and selector2 CNAMEs.
microsoft-365.custom_domain_dkim_off
Sources
Reviewed by healthcheck.email on 2026-10-09.