{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/", "slug": "dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation", "url": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/" }, "title": "Allow for the signing delay when verifying Microsoft 365 DKIM rotation", "summary": "When should a newly rotated Microsoft 365 DKIM key appear in outbound message signatures?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:31:43+00:00", "modified_at": "2026-09-17T16:46:30+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 197, "potentially_affected": "Apply this check to the documented Microsoft 365 DKIM key-rotation workflow for a custom domain. Capture the domain's rotation properties and the expected selector before evaluating test messages.", "dse_recommendation": "DSE recommends recording RotateOnDate and the before-and-after selector values in the change evidence.", "primary_source": { "name": "How to use DKIM for email in your custom domain - Microsoft Defender for Office 365 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft states that a DKIM rotation takes four days, or 96 hours, before the new private key starts signing messages; the existing key signs during that interval. Microsoft directs administrators to inspect the s= selector in the DKIM-Signature header to identify the corresponding verification key. Another rotation cannot be started while the current rotation is in progress. Microsoft Learn.

\n

Applicability

\n

Apply this check to the documented Microsoft 365 DKIM key-rotation workflow for a custom domain. Capture the domain’s rotation properties and the expected selector before evaluating test messages.

\n

DSE recommendation

\n

DSE recommends recording RotateOnDate and the before-and-after selector values in the change evidence. Schedule verification against that transition time, and explain the continuing use of the prior selector during the documented interval. Keep the domain’s current authentication configuration available to the support owner.

\n

Verification

\n

Send approved test messages through the relevant outbound path before and after the scheduled change. Preserve the headers, sending time and observed selector, then compare them with the rotation properties. Investigate an unexpected result using the actual domain and message path before attempting another configuration change.

\n

Official references

\n

Microsoft Learn: Set up DKIM to sign mail from your cloud domain. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft states that a DKIM rotation takes four days, or 96 hours, before the new private key starts signing messages; the existing key signs during that interval. Microsoft directs administrators to inspect the s= selector in the DKIM-Signature header to identify the corresponding verification key. Another rotation cannot be started while the current rotation is in progress. Microsoft Learn.\nApplicability\nApply this check to the documented Microsoft 365 DKIM key-rotation workflow for a custom domain. Capture the domain’s rotation properties and the expected selector before evaluating test messages.\nDSE recommendation\nDSE recommends recording RotateOnDate and the before-and-after selector values in the change evidence. Schedule verification against that transition time, and explain the continuing use of the prior selector during the documented interval. Keep the domain’s current authentication configuration available to the support owner.\nVerification\nSend approved test messages through the relevant outbound path before and after the scheduled change. Preserve the headers, sending time and observed selector, then compare them with the rotation properties. Investigate an unexpected result using the actual domain and message path before attempting another configuration change.\nOfficial references\nMicrosoft Learn: Set up DKIM to sign mail from your cloud domain. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft states that a DKIM rotation takes four days, or 96 hours, before the new private key starts signing messages; the existing key signs during that interval. Microsoft directs administrators to inspect the s= selector in the DKIM-Signature header to identify the corresponding verification key. Another rotation cannot be started while the current rotation is in progress. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure).\n\n## Applicability\n\nApply this check to the documented Microsoft 365 DKIM key-rotation workflow for a custom domain. Capture the domain’s rotation properties and the expected selector before evaluating test messages.\n\n## DSE recommendation\n\nDSE recommends recording RotateOnDate and the before-and-after selector values in the change evidence. Schedule verification against that transition time, and explain the continuing use of the prior selector during the documented interval. Keep the domain’s current authentication configuration available to the support owner.\n\n## Verification\n\nSend approved test messages through the relevant outbound path before and after the scheduled change. Preserve the headers, sending time and observed selector, then compare them with the rotation properties. Investigate an unexpected result using the actual domain and message path before attempting another configuration change.\n\n## Official references\n\n[Microsoft Learn: Set up DKIM to sign mail from your cloud domain](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Allow for the signing delay when verifying Microsoft 365 DKIM rotation", "item": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/", "headline": "Allow for the signing delay when verifying Microsoft 365 DKIM rotation", "description": "When should a newly rotated Microsoft 365 DKIM key appear in outbound message signatures?", "abstract": "When should a newly rotated Microsoft 365 DKIM key appear in outbound message signatures?", "articleBody": "Source facts\nMicrosoft states that a DKIM rotation takes four days, or 96 hours, before the new private key starts signing messages; the existing key signs during that interval. Microsoft directs administrators to inspect the s= selector in the DKIM-Signature header to identify the corresponding verification key. Another rotation cannot be started while the current rotation is in progress. Microsoft Learn.\nApplicability\nApply this check to the documented Microsoft 365 DKIM key-rotation workflow for a custom domain. Capture the domain’s rotation properties and the expected selector before evaluating test messages.\nDSE recommendation\nDSE recommends recording RotateOnDate and the before-and-after selector values in the change evidence. Schedule verification against that transition time, and explain the continuing use of the prior selector during the documented interval. Keep the domain’s current authentication configuration available to the support owner.\nVerification\nSend approved test messages through the relevant outbound path before and after the scheduled change. Preserve the headers, sending time and observed selector, then compare them with the rotation properties. Investigate an unexpected result using the actual domain and message path before attempting another configuration change.\nOfficial references\nMicrosoft Learn: Set up DKIM to sign mail from your cloud domain. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:31:43+00:00", "dateModified": "2026-09-17T16:46:30+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Allow for the signing delay when verifying Microsoft 365 DKIM rotation" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 197, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "How to use DKIM for email in your custom domain - Microsoft Defender for Office 365 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure" } } ] } }