Why is my Azure DNS DKIM record not resolving immediately?

DNS changes require time to propagate across global nameservers, and local caching on your machine or local network can delay visibility. You can bypass local caching by querying your Azure authoritative nameservers directly using tools like dig or nslookup.

Should I use CNAME or TXT records for Microsoft 365 DKIM in Azure?

Microsoft 365 typically requires two CNAME records for DKIM configuration. Using CNAME records is recommended because it allows Microsoft to automatically manage and rotate your signing keys without requiring manual DNS updates.

How do I find my Azure DNS authoritative nameservers?

Navigate to your DNS zone in the Azure Portal and look at the Overview blade. You will find a list of four nameservers assigned to your zone, typically ending in azuredns.com, azuredns.net, azuredns.org, or azuredns.info.

Can I configure DKIM in Azure DNS using Azure CLI?

Yes, you can use the 'az network dns record-set cname create' and 'az network dns record-set cname set-record' commands in Azure CLI or Azure PowerShell to script and automate your DKIM record deployments.

What happens if my DKIM record is misconfigured?

If your DKIM record is missing, malformed, or points to the wrong target, receiving mail servers will fail cryptographic validation. This often causes your emails to be flagged as spam or rejected outright by strict mailbox providers.

Azure DNS DKIM Configuration: Step-by-Step Guide

Configuring DomainKeys Identified Mail (DKIM) for your domain hosted in Azure DNS involves creating specific CNAME or TXT records provided by your email service provider to cryptographically sign outgoing messages. Proper Azure DNS DKIM configuration ensures receiving servers can verify the authenticity of your emails, protecting your domain from spoofing and significantly improving inbox delivery rates.

To ensure your setup is fully operational and to quickly troubleshoot any typos or propagation delays, you can use the free DKIM Checker on XiaTools to query your public nameservers and confirm your keys are publicly readable.

Understanding DKIM and Azure DNS Architecture

DKIM works by adding a digital signature to the headers of every outgoing email. The receiving mail server queries the sending domain's DNS to retrieve the public key matching the selector used in the signature. If the cryptographic verification succeeds, the email passes authentication.

When managing domains via Azure DNS, you are utilizing Microsoft's globally distributed cloud DNS infrastructure. Azure DNS provides high availability and ultra-low latency name resolution, making it an enterprise-grade choice for publishing your email authentication records, including SPF, DKIM, and DMARC.

CNAME vs TXT Records for DKIM

Depending on your email provider (such as Microsoft 365, Google Workspace, SendGrid, or Mailgun), you will be asked to publish either TXT records or CNAME records.

CNAME Records: Providers like Microsoft 365 often use CNAME-based DKIM (often called CNAME flattening or pointing to the provider's domain). This allows the provider to automatically rotate your private and public keys periodically without requiring manual updates in your Azure DNS zone.
TXT Records: Some providers require you to paste the full public key directly into a TXT record. These require manual intervention if the keys need to be rolled over for security reasons.

Step-by-Step Azure DNS DKIM Configuration

Follow these steps to add your DKIM records into an existing Azure DNS Zone using the Azure Portal. If you prefer automation, you can replicate these steps using Azure CLI or Azure PowerShell.

Step 1: Gather Your DKIM Record Details

Log into your email service provider's administrative console and navigate to their domain settings or email authentication section. Locate the DKIM settings and copy the required hostname (selector) and the target value or TXT content.

For example, assume your email provider gives you the following details:

Record Type: CNAME
Name (Selector): selector1._domainkey
Value/Target: selector1-example-com._domainkey.mailprovider.com

Step 2: Open Azure DNS Zone

Log into the Azure Portal.
In the global search bar, type DNS zones and select your domain (e.g., example.com) from the list.

Step 3: Create the Record Set

Inside your DNS zone overview page, click the + Record set button at the top command bar.
In the pane that opens on the right, fill out the fields based on your provider's instructions:
- Name: Enter the selector prefix only. Do not include your root domain name. For selector1._domainkey.example.com, simply enter selector1._domainkey.
- Type: Select CNAME or TXT depending on your provider.
- TTL (Time to Live): Leave the default (typically 1 hour or 3600 seconds) or lower it to 300 seconds if you want faster propagation during testing.
- TTL unit: Select Seconds.
- Value: Paste the target CNAME destination or the full public key string.
Click OK at the bottom to create the record.

Example Record Configurations

Record Type	Name (Selector)	Value / Target	Description
CNAME	`selector1._domainkey`	`selector1-example-com._domainkey.mailprovider.com`	Points your selector to your email provider's DNS infrastructure.
TXT	`mail._domainkey`	`v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQ...`	Publishes the raw public key directly in Azure DNS.
CNAME	`selector2._domainkey`	`selector2-example-com._domainkey.mailprovider.com`	Second required CNAME record for key rotation redundancy.

Verifying Your DKIM Configuration

Once you have published the records in Azure DNS, you must verify that public nameservers are serving them correctly. DNS propagation usually takes anywhere from a few seconds to a few minutes, though global propagation can occasionally take up to an hour.

Using Command Line Tools

You can query your Azure DNS nameservers directly using dig or nslookup from your local terminal.

# Query the CNAME record using dig
dig @ns1-01.azure-dns.com selector1._domainkey.example.com CNAME

# Query a TXT record using nslookup
nslookup -type=TXT selector1._domainkey.example.com ns1-01.azure-dns.com

Expected sample output for a successful CNAME query:

;; QUESTION SECTION:
;selector1._domainkey.example.com. IN CNAME

;; ANSWER SECTION:
selector1._domainkey.example.com. 3600 IN CNAME selector1-example-com._domainkey.mailprovider.com.

PowerShell Verification

If you are on Windows, you can use PowerShell to check record propagation:

Resolve-DnsName -Name "selector1._domainkey.example.com" -Type CNAME -Server "ns1-01.azure-dns.com"

Common Mistakes and How to Fix Them

Even experienced engineers occasionally run into configuration pitfalls when managing DNS zones in Azure.

Redundant Domain Append in the Name Field: Azure DNS automatically appends your zone name to the record name. If you type selector1._domainkey.example.com into the Name field, Azure will mistakenly create selector1._domainkey.example.com.example.com. Always strip your root domain name from the selector.
Incorrect Record Type: Mixing up CNAME and TXT records will cause validation failures. Ensure the record type in Azure matches the exact specifications provided by your email host.
Syntax Errors in TXT Strings: If your provider uses TXT records, ensure quotation marks and semicolons are properly formatted without accidental line breaks or trailing whitespace.
Ignoring Secondary Selectors: Many modern providers require two distinct selectors (e.g., selector1 and selector2) for seamless key rotation. Configuring only one can lead to failures when the provider rotates keys.

Azure DNS DKIM Setup Checklist

Gathered accurate selector names and targets from your email provider.
Logged into the Azure Portal and opened the correct DNS zone.
Added record sets with the correct type (CNAME or TXT).
Ensured the Name field contains only the selector prefix, not the full domain.
Verified record resolution using dig, nslookup, or online validation tools.
Tested outbound email delivery to external mailboxes to confirm signing.

Azure DNS Zone: How to Add and Verify DKIM Records