How do I set up DKIM at Amazon Route 53 for Microsoft 365?

What does DKIM do?

It adds a signature to each message your domain sends. A mail server checks the signature against a key published in your DNS, so a message changed or forged on the way fails.

Where does Microsoft 365 make the key?

In the Defender portal, go to Email & collaboration, then Policies & rules, then Threat policies, then Email authentication settings, and open the DKIM tab. Select your domain. Under Publish CNAMEs, Microsoft shows the two values for your domain. Copy them from there: they differ by domain, and a newer domain uses a newer format.

selector1._domainkey

selector2._domainkey

How do I add them at Amazon Route 53?

1. Sign in to the AWS console and open Route 53.
2. Choose Hosted zones, then choose the zone named for your domain.
3. Choose Create record, keep Simple routing, and set Record type to CNAME.
4. Type selector1._domainkey in Record name.Leave your domain name out: it is added for you.
5. Paste the first value Microsoft shows in Value, exactly as copied.
6. Choose Create records.
7. Add the second record the same way, named selector2._domainkey, with the second value.

In our words, from Amazon Route 53: adding a CNAME record, read 14 October 2026. If a screen has changed since, follow the host's own page.

How do I turn signing on?

Go back to the DKIM tab in the Defender portal, select your domain, and set Sign messages for this domain with DKIM signatures to Enabled. If the portal says the records are missing, wait for your DNS change to be seen and try again.