# Allow for the signing delay when verifying Microsoft 365 DKIM rotation

> When should a newly rotated Microsoft 365 DKIM key appear in outbound message signatures?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:31:43+00:00
- Modified: 2026-09-17T16:46:30+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

When should a newly rotated Microsoft 365 DKIM key appear in outbound message signatures?

## Potentially affected

Apply this check to the documented Microsoft 365 DKIM key-rotation workflow for a custom domain. Capture the domain's rotation properties and the expected selector before evaluating test messages.

## DSE recommendation

DSE recommends recording RotateOnDate and the before-and-after selector values in the change evidence.

## Article

## Source facts

Microsoft states that a DKIM rotation takes four days, or 96 hours, before the new private key starts signing messages; the existing key signs during that interval. Microsoft directs administrators to inspect the s= selector in the DKIM-Signature header to identify the corresponding verification key. Another rotation cannot be started while the current rotation is in progress. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure).

## Applicability

Apply this check to the documented Microsoft 365 DKIM key-rotation workflow for a custom domain. Capture the domain’s rotation properties and the expected selector before evaluating test messages.

## DSE recommendation

DSE recommends recording RotateOnDate and the before-and-after selector values in the change evidence. Schedule verification against that transition time, and explain the continuing use of the prior selector during the documented interval. Keep the domain’s current authentication configuration available to the support owner.

## Verification

Send approved test messages through the relevant outbound path before and after the scheduled change. Preserve the headers, sending time and observed selector, then compare them with the rotation properties. Investigate an unexpected result using the actual domain and message path before attempting another configuration change.

## Official references

[Microsoft Learn: Set up DKIM to sign mail from your cloud domain](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure). Source reviewed September 17, 2026.

## Primary reference

- Name: How to use DKIM for email in your custom domain - Microsoft Defender for Office 365 | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Allow for the signing delay when verifying Microsoft 365 DKIM rotation,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-197-allow-for-the-signing-delay-when-verifying-microsoft-365-dkim-rotation/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.