What you’re seeing
- Message headers on mail you send show "dkim=fail" or "dkim=none" for your own domain.
- One of the two DKIM selector records (selector1 or selector2) never validates, so DKIM signing can't be switched on or keeps reporting an error.
- DMARC reports from receiving providers list your Microsoft 365 traffic as failing DKIM.
- Recipients see caution banners on your messages, or your mail lands in spam more often than it used to.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- One of the two DKIM CNAME records was never published at your DNS host, or it was entered with the wrong target value.
- Your DNS provider automatically appended your domain to the record name, creating a doubled host name that Microsoft 365 can't find.
- Only the default onmicrosoft.com domain is signing mail, so the signature on your messages doesn't align with your custom domain.
- A key rotation switched signing to the second selector, and that selector's DNS record was missing or wrong.
- A mail gateway, disclaimer service or email signature tool alters messages after they're signed, which breaks the signature.
- An old or conflicting DKIM record with a long cache time is still being served while the new one propagates.
Why it matters
DKIM is one of the three checks receiving mail servers use to decide whether a message really came from you. When it fails, your domain looks less trustworthy, and once you enforce DMARC, failing DKIM can mean outright rejection of invoices, proposals and customer replies. A selector that never validates is a quiet risk: everything seems fine until Microsoft rotates keys and signing suddenly breaks. Weak authentication also makes it easier for criminals to spoof your domain in phishing emails sent to your own customers and vendors.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Why does Microsoft 365 need two DKIM selector records?
Microsoft uses two selectors so it can rotate signing keys without interrupting mail. Both records must be correct, because signing alternates between them over time.
Does a DKIM failure mean someone has hacked our email?
Usually not. DKIM failures almost always come from DNS or configuration problems rather than a compromise, though they do make your domain easier for others to impersonate.
Will the fix interrupt our email or website?
No. The work involves DNS records and Microsoft 365 settings that don't affect your website, and mail keeps flowing while the change takes effect. We confirm the cause before changing anything.