How do I set up DKIM at Squarespace for Microsoft 365?

What does DKIM do?

It adds a signature to each message your domain sends. A mail server checks the signature against a key published in your DNS, so a message changed or forged on the way fails.

Where does Microsoft 365 make the key?

In the Defender portal, go to Email & collaboration, then Policies & rules, then Threat policies, then Email authentication settings, and open the DKIM tab. Select your domain. Under Publish CNAMEs, Microsoft shows the two values for your domain. Copy them from there: they differ by domain, and a newer domain uses a newer format.

selector1._domainkey

selector2._domainkey

How do I add them at Squarespace?

1. Sign in to Squarespace, open your domains dashboard and click your domain.
2. Click DNS, then DNS Settings, and scroll down to Custom Records.
3. Click Add record, confirm your password if asked, and choose CNAME in the Type menu.
4. Type selector1._domainkey in Name.Leave your domain name out: it is added for you.
5. Paste the first value Microsoft shows in Data, exactly as copied.
6. Click Save.
7. Add the second record the same way, named selector2._domainkey, with the second value.

In our words, from Squarespace: adding a CNAME record, read 14 October 2026. If a screen has changed since, follow the host's own page.

How do I turn signing on?

Go back to the DKIM tab in the Defender portal, select your domain, and set Sign messages for this domain with DKIM signatures to Enabled. If the portal says the records are missing, wait for your DNS change to be seen and try again.