Back to Checks
m365

Exchange Online domain has DKIM enabled

defender_domain_dkim_enabled
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:email-securitye3
Resource Type:NotDefined

Microsoft 365 Exchange Online domains use DKIM signing for outbound mail. This evaluates each domain to confirm an active DKIM configuration so messages include a verifiable signature via the domain's DKIM selectors.

Prowler logoProwlerprowler-provider-m365

Risk

Without DKIM, recipients can't verify sender authenticity, enabling domain spoofing and BEC phishing.

Attackers can impersonate trusted mail to steal credentials, deliver malware, and pivot internally, impacting confidentiality and integrity. Messages may also fail DMARC alignment, reducing deliverability and trust.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks defender_domain_dkim_enabled

Recommendation

  • Enable DKIM signing for all sending domains and subdomains
  • Combine with SPF and DMARC to enforce alignment (defense in depth)
  • Apply least privilege to mail auth settings
  • Rotate DKIM keys regularly and monitor authentication results to detect anomalies

Remediation

CLI

Set-DkimSigningConfig -Identity <domainName> -Enabled $true

Other

1Sign in to Microsoft 365 Defender: https://security.microsoft.com
2Go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM
3Select the domain and enable "Sign messages for this domain with DKIM signatures"
4If prompted for CNAMEs, publish the two records shown at your DNS provider, wait for DNS to update, then return and enable in step 3

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.defender.defender_client import defender_client


class defender_domain_dkim_enabled(Check):
    """
    Check if DKIM is enabled for all Exchange Online domains.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the check to verify if DKIM is enabled for all domains.

        This method checks the DKIM signing configuration for each domain to determine if DKIM is enabled.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        for config in defender_client.dkim_configurations:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=config,
                resource_name=config.id,
                resource_id=config.id,
            )
            report.status = "FAIL"
            report.status_extended = (
                f"DKIM is not enabled for domain with ID {config.id}."
            )

            if config.dkim_signing_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"DKIM is enabled for domain with ID {config.id}."
                )

            findings.append(report)

        return findings

References