Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
defender_domain_dkim_enabledProvider: Microsoft 365
Service:
defenderSeverity: HIGH
Categories:
email-security, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 Exchange Online domains use DKIM signing for outbound mail. This evaluates each domain to confirm an active DKIM configuration so messages include a verifiable signature via the domain’s DKIM selectors.Risk
Without DKIM, recipients can’t verify sender authenticity, enabling domain spoofing and BEC phishing. Attackers can impersonate trusted mail to steal credentials, deliver malware, and pivot internally, impacting confidentiality and integrity. Messages may also fail DMARC alignment, reducing deliverability and trust.Recommendation
- Enable DKIM signing for all sending domains and subdomains
- Combine with SPF and DMARC to enforce alignment (defense in depth)
- Apply least privilege to mail auth settings
- Rotate DKIM keys regularly and monitor authentication results to detect anomalies
Remediation
- CLI
- Dashboard steps
Set-DkimSigningConfig -Identity <domainName> -Enabled $true
References
- https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-dkimsigningconfig?view=exchange-ps
- https://learn.microsoft.com/en-us/powershell/module/exchange/set-dkimsigningconfig?view=exchange-ps
- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email?view=o365-worldwide
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_domain_dkim_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks