FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 5,242,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
FaultyPacket Fix Guide · reviewed Oct 2026

Microsoft 365 DKIM Not Signing ("CNAME Record Does Not Exist") — How to Fix

The short answer (what's causing it)

By default Microsoft 365 signs with your *.onmicrosoft.com domain, which does not align with your custom From: domain. Enabling custom DKIM requires two selector CNAMEs in your public DNS; if they're missing or mistyped, Defender shows "CNAME record does not exist" and signing stays off.

Step-by-step fix

  1. In Microsoft Defender portal → Email & collaboration → Policies → Email authentication settings → DKIM, select your domain and copy the two CNAME targets shown.
  2. Publish selector1._domainkey and selector2._domainkey CNAMEs exactly as shown (formats vary by tenant — always copy from the portal).
  3. Wait for DNS propagation, then toggle Sign messages for this domain with DKIM signatures on.
  4. Send a test and check headers for dkim=pass header.d=yourdomain.
  5. Scan free to confirm both selectors resolve.

Record examples (replace example.co.uk with your domain)

selector1._domainkey.example.co.uk. CNAME selector1-example-co-uk._domainkey.<tenant>.<value-from-portal>
selector2._domainkey.example.co.uk. CNAME selector2-example-co-uk._domainkey.<tenant>.<value-from-portal>

Examples are illustrative templates, not values for your domain. Test changes at p=none / staging first.

Check yours free in seconds

Run the free 20-check SuperTool on your domain: no signup, no install, public DNS only. Relevant checks: DKIM, DNS TXT, DMARC.

Scan my domain free (20-check SuperTool) → £24 Sovereign DMARC (T0 RUA), SPF, MTA-STS & PHP2Shell Remediation Pack → £5 Website Launch Special Quick-Fix Pack →

One-off download via PayPal guest checkout, no subscription. Packs contain DNS/config templates and scripts you run yourself.

Frequently Asked Questions

Why does the error persist after adding records?

Propagation delay, a trailing dot / auto-appended zone name in your DNS host, or a typo in the target.

Can I use PowerShell?

Yes: `Get-DkimSigningConfig` shows the expected CNAMEs; `Set-DkimSigningConfig -Enabled $true` enables it.

Related FaultyPacket guides & tools

Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.