Allow for the signing delay when verifying Microsoft 365 DKIM rotation

Source facts

Microsoft states that a DKIM rotation takes four days, or 96 hours, before the new private key starts signing messages; the existing key signs during that interval. Microsoft directs administrators to inspect the s= selector in the DKIM-Signature header to identify the corresponding verification key. Another rotation cannot be started while the current rotation is in progress. Microsoft Learn.

Applicability

Apply this check to the documented Microsoft 365 DKIM key-rotation workflow for a custom domain. Capture the domain’s rotation properties and the expected selector before evaluating test messages.

DSE recommendation

DSE recommends recording RotateOnDate and the before-and-after selector values in the change evidence. Schedule verification against that transition time, and explain the continuing use of the prior selector during the documented interval. Keep the domain’s current authentication configuration available to the support owner.

Verification

Send approved test messages through the relevant outbound path before and after the scheduled change. Preserve the headers, sending time and observed selector, then compare them with the rotation properties. Investigate an unexpected result using the actual domain and message path before attempting another configuration change.

Official references

Microsoft Learn: Set up DKIM to sign mail from your cloud domain. Source reviewed September 17, 2026.