DKIM with CNAME records: delegated selectors (Microsoft 365, SendGrid…)

What it means

A DKIM key is normally a long TXT record published at a name like selector._domainkey.yourdomain.com. Many providers, such as Microsoft 365, SendGrid, Mailchimp or Amazon SES, ask you instead to add a CNAME record at that name.

A CNAME is a pointer. It says "the answer is over there, at the provider's domain". The provider then publishes the real key on its side. This is called a delegated selector. Its big advantage: the provider can change (rotate) the key without you touching your DNS.

Typical examples:

selector1._domainkey.yourdomain.com  CNAME  (value shown in Microsoft 365)
selector2._domainkey.yourdomain.com  CNAME  (value shown in Microsoft 365)
s1._domainkey.yourdomain.com         CNAME  s1.domainkey.u1234.wl.sendgrid.net

Why it matters

• If the CNAME is wrong, receivers find no key and DKIM fails, even though the provider signs correctly.
• Microsoft 365 and other tools refuse to enable DKIM signing until they can see your CNAMEs.
• Without an aligned DKIM signature, DMARC depends only on SPF, which breaks with forwarding.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report.
• Use the Domain scanner: type your domain at /domain-scanner to read your SPF, DMARC and MX records without sending anything.

In the report, the DKIM line shows which domain signed (d=) and whether the key was found.

How to fix it

1. Copy the exact values from your provider. Do not guess them: Microsoft 365 values contain your domain and tenant name, SendGrid values contain your account number.
2. Create CNAME records, not TXT. If a TXT record already exists at the same name, delete it: a name cannot hold a CNAME and another record at the same time.
3. Check the name field. Many DNS panels add your domain automatically. Type selector1._domainkey, not the full name, or you get selector1._domainkey.yourdomain.com.yourdomain.com.
4. Turn off proxying. On Cloudflare, set DKIM CNAMEs to "DNS only" (grey cloud). A proxied record does not return the key.
5. Add all the records asked. Microsoft 365 uses two selectors and switches between them when it rotates keys. If you add only one, DKIM breaks at the next rotation.
6. Activate signing in the provider. In Microsoft 365, DKIM must be enabled for your domain in the Defender portal after the CNAMEs are visible. Other tools have a "Verify" button.

Test the CNAME yourself

On a computer, run:

nslookup -type=TXT selector1._domainkey.yourdomain.com

You should see the CNAME followed by the key (v=DKIM1; k=rsa; p=...). No answer means the CNAME is missing or misspelled.

Check that it is fixed

DNS changes can take from a few minutes to 48 hours. Once the provider confirms the records, send a new email to a fresh Delivmail test address. The report should show DKIM passing with d=yourdomain.com, and DMARC passing.

Official help: Microsoft 365 DKIM guide.