dkimSigningConfigs

DKIM Signing. Per-domain DKIM email-signing configuration and key rotation. The dkimSigningConfigs entity set lives under /exchange/v1.0/dkimSigningConfigs in the Mail flow category.

Fact	Value
Path	/exchange/v1.0/dkimSigningConfigs
Category	Mail flow
Tier	Tier 3, Mail flow
Read role	MailFlow.Read.All (Community)
Write role	MailFlow.ReadWrite.All (Pro)
Backing cmdlets	Get-DkimSigningConfig, Set-DkimSigningConfig, New-DkimSigningConfig, Remove-DkimSigningConfig, Rotate-DkimSigningConfig

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/dkimSigningConfigs	List dkimSigningConfigs entries.	MailFlow.Read	Community
POST	/exchange/v1.0/dkimSigningConfigs	Create a new dkimSigningConfigs entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.	MailFlow.ReadWrite	Pro
GET	/exchange/v1.0/dkimSigningConfigs/{key}	Get a single dkimSigningConfigs entry by Identity.	MailFlow.Read	Community
PATCH	/exchange/v1.0/dkimSigningConfigs/{key}	Partial update of the dkimSigningConfigs at /dkimSigningConfigs/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).	MailFlow.ReadWrite	Pro
DELETE	/exchange/v1.0/dkimSigningConfigs/{key}	DELETE /dkimSigningConfigs/{key}. Use ?force=true to skip EXO’s confirmation guard (Remove-DkimSigningConfig -Force).	MailFlow.ReadWrite	Pro
POST	/exchange/v1.0/dkimSigningConfigs/{key}/rotate	POST /dkimSigningConfigs/{key}/rotate - bound action that rotates the DKIM keypair via Rotate-DkimSigningConfig. Optional ?keySize=1024|2048 overrides the default. No body. Returns 204.	MailFlow.ReadWrite	Pro

GET /exchange/v1.0/dkimSigningConfigs

List dkimSigningConfigs entries.

Backing cmdlet: Get-DkimSigningConfig. Role: MailFlow.Read (Community).

List DKIM signing configurations

Returns the DKIM signing configurations for the tenant’s accepted domains. Backed by the Get-DkimSigningConfig cmdlet; supports paging via $top.

GET /exchange/v1.0/dkimSigningConfigs?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#dkimSigningConfigs",
  "value": [
    {
      "Id": "contoso.com",
      "Name": "contoso.com",
      "Identity": "contoso.com",
      "Domain": "contoso.com",
      "Guid": "85568172-bd18-458a-9dbe-c6a2d5a4c662",
      "Enabled": true,
      "Status": "Valid",
      "KeySize": null,
      "Selector1Name": null,
      "Selector2Name": null,
      "Selector1CNAME": "selector1-contoso-com._domainkey.contoso.onmicrosoft.com",
      "Selector2CNAME": "selector2-contoso-com._domainkey.contoso.onmicrosoft.com",
      "Selector1KeySize": "2048",
      "Selector2KeySize": "2048",
      "LastChecked": "2024-12-10T18:04:53.5455177Z",
      "Selector1PublicKey": null,
      "Selector2PublicKey": null,
      "IsDefault": "False",
      "IsSignatureSendingAllowed": false,
      "WhenCreated": "2026-03-30T17:19:46+03:00",
      "WhenChanged": "2026-03-30T17:19:47+03:00",
      "AdminDisplayName": "",
      "Algorithm": "RsaSHA256",
      "BodyCanonicalization": "Relaxed",
      "DistinguishedName": "CN=contoso.com,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
      "ExchangeObjectId": "ae28f2d5-f645-437b-91e5-52963909d5ca",
      "HeaderCanonicalization": "Relaxed",
      "IncludeKeyExpiration": false,
      "IncludeSignatureCreationTime": true,
      "KeyCreationTime": "2024-12-04T16:12:01.5593966Z",
      "NumberOfBytesToSign": "All",
      "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
      "OrganizationalUnitRoot": "contoso.onmicrosoft.com",
      "RotateOnDate": "2024-12-04T16:12:01.5593966Z",
      "SelectorAfterRotateOnDate": "selector1",
      "SelectorBeforeRotateOnDate": "selector2",
      "WhenChangedUTC": "2026-03-30T14:19:47Z",
      "WhenCreatedUTC": "2026-03-30T14:19:46Z"
    },
    {
      "Id": "contoso.onmicrosoft.com",
      "Name": "contoso.onmicrosoft.com",
      "Identity": "contoso.onmicrosoft.com",
      "Domain": "contoso.onmicrosoft.com",
      "Guid": "6742507f-60ee-4b74-b0a7-b37aff2a4c68",
      "Enabled": true,
      "Status": "Valid",
      "KeySize": null,
      "Selector1Name": null,
      "Selector2Name": null,
      "Selector1CNAME": "selector1-contoso-onmicrosoft-com._domainkey.contoso.onmicrosoft.com",
      "Selector2CNAME": "selector2-contoso-onmicrosoft-com._domainkey.contoso.onmicrosoft.com",
      "Selector1KeySize": "2048",
      "Selector2KeySize": "2048",
      "LastChecked": "2024-12-10T18:05:05.8152983Z",
      "Selector1PublicKey": null,
      "Selector2PublicKey": null,
      "IsDefault": "True",
      "IsSignatureSendingAllowed": false,
      "WhenCreated": "2026-03-30T17:42:35+03:00",
      "WhenChanged": "2026-03-30T17:42:44+03:00",
      "AdminDisplayName": "",
      "Algorithm": "RsaSHA256",
      "BodyCanonicalization": "Relaxed",
      "DistinguishedName": "CN=contoso.onmicrosoft.com,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
      "ExchangeObjectId": "1c069e2d-aea4-4f74-9b2b-3d3d8b9f6b6c",
      "HeaderCanonicalization": "Relaxed",
      "IncludeKeyExpiration": false,
      "IncludeSignatureCreationTime": true,
      "KeyCreationTime": "2024-12-10T18:05:00.0024682Z",
      "NumberOfBytesToSign": "All",
      "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
      "OrganizationalUnitRoot": "contoso.onmicrosoft.com",
      "RotateOnDate": "2024-12-10T18:05:00.0024682Z",
      "SelectorAfterRotateOnDate": "selector1",
      "SelectorBeforeRotateOnDate": "selector2",
      "WhenChangedUTC": "2026-03-30T14:42:44Z",
      "WhenCreatedUTC": "2026-03-30T14:42:35Z"
    }
  ]
}

Notes: Key is the domain name. Selector1/2 CNAME values are the DNS records to publish for DKIM. The default domain has IsDefault “True”.

Related: GET /exchange/v1.0/dkimSigningConfigs/{key}

POST /exchange/v1.0/dkimSigningConfigs

Create a new dkimSigningConfigs entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.

Backing cmdlet: New-DkimSigningConfig. Role: MailFlow.ReadWrite (Pro).

Parameter	In	Type	Required	Description
domainName	body		yes
enabled	body		yes
adminDisplayName	body
bodyCanonicalization	body
headerCanonicalization	body
keySize	body
dryRun	query	bool (switch)

Create rejected when domainName is missing

New-DkimSigningConfig requires domainName (the identity) and enabled. Omitting domainName returns a 400 BadRequest before the cmdlet is invoked.

POST /exchange/v1.0/dkimSigningConfigs HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "enabled": true,
  "adminDisplayName": "exonaut-sample-dkimSigningConfigs"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The required field 'domainName' is required.",
    "target": "domainName"
  },
  "correlationId": "0HN7Q2K3M9F4P:00000007"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/dkimSigningConfigs

Enable DKIM signing for a domain

Creates a DKIM signing configuration for an accepted domain via New-DkimSigningConfig. Required fields are domainName (the identity) and enabled; optional fields tune key size and canonicalization.

POST /exchange/v1.0/dkimSigningConfigs HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "domainName": "contoso.com",
  "enabled": true,
  "adminDisplayName": "exonaut-sample-dkimSigningConfigs",
  "keySize": 2048,
  "bodyCanonicalization": "Relaxed",
  "headerCanonicalization": "Relaxed"
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/dkimSigningConfigs/contoso.com

{
  "Id": "contoso.com",
  "Identity": "contoso.com",
  "domainName": "contoso.com",
  "enabled": true,
  "adminDisplayName": "exonaut-sample-dkimSigningConfigs",
  "keySize": 2048,
  "bodyCanonicalization": "Relaxed",
  "headerCanonicalization": "Relaxed"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/dkimSigningConfigs

GET /exchange/v1.0/dkimSigningConfigs/{key}

Get a single dkimSigningConfigs entry by Identity.

Backing cmdlet: Get-DkimSigningConfig. Role: MailFlow.Read (Community).

Get a single dkimSigningConfigs entry

Returns the DKIM signing configuration for a single domain. Backed by Get-DkimSigningConfig with -Identity {key}, where {key} is the domain name.

GET /exchange/v1.0/dkimSigningConfigs/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#dkimSigningConfigs/$entity",
  "Id": "contoso.com",
  "Name": "contoso.com",
  "Identity": "contoso.com",
  "Domain": "contoso.com",
  "Guid": "85568172-bd18-458a-9dbe-c6a2d5a4c662",
  "Enabled": true,
  "Status": "Valid",
  "KeySize": null,
  "Selector1Name": null,
  "Selector2Name": null,
  "Selector1CNAME": "selector1-contoso-com._domainkey.contoso.onmicrosoft.com",
  "Selector2CNAME": "selector2-contoso-com._domainkey.contoso.onmicrosoft.com",
  "Selector1KeySize": "2048",
  "Selector2KeySize": "2048",
  "LastChecked": "2024-12-10T18:04:53.5455177Z",
  "Selector1PublicKey": null,
  "Selector2PublicKey": null,
  "IsDefault": "False",
  "IsSignatureSendingAllowed": false,
  "WhenCreated": "2026-03-30T17:19:46+03:00",
  "WhenChanged": "2026-03-30T17:19:47+03:00",
  "AdminDisplayName": "",
  "Algorithm": "RsaSHA256",
  "BodyCanonicalization": "Relaxed",
  "DistinguishedName": "CN=contoso.com,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
  "ExchangeObjectId": "ae28f2d5-f645-437b-91e5-52963909d5ca",
  "HeaderCanonicalization": "Relaxed",
  "IncludeKeyExpiration": false,
  "IncludeSignatureCreationTime": true,
  "KeyCreationTime": "2024-12-04T16:12:01.5593966Z",
  "NumberOfBytesToSign": "All",
  "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
  "OrganizationalUnitRoot": "contoso.onmicrosoft.com",
  "RotateOnDate": "2024-12-04T16:12:01.5593966Z",
  "SelectorAfterRotateOnDate": "selector1",
  "SelectorBeforeRotateOnDate": "selector2",
  "WhenChangedUTC": "2026-03-30T14:19:47Z",
  "WhenCreatedUTC": "2026-03-30T14:19:46Z"
}

Notes: The {key} is the domain name (e.g. contoso.com), not a GUID. Returns 404 if the domain isn’t a DKIM-configured accepted domain.

Related: GET /exchange/v1.0/dkimSigningConfigs

Get a single dkimSigningConfigs entry - not found

When the supplied {key} (domain) doesn’t resolve to a DKIM signing configuration, the API returns a 404 with the canonical error envelope. Backed by Get-DkimSigningConfig with -Identity {key}.

GET /exchange/v1.0/dkimSigningConfigs/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 404 Not Found

{
  "error": {
    "code": "NotFound",
    "message": "Exchange object 'does-not-exist-12345' could not be found.",
    "target": "identity",
    "innerError": {
      "cmdlet": "Get-DkimSigningConfig"
    }
  },
  "correlationId": "0HNLSU6PPVJ03:00000001"
}

Notes: The {key} must be a DKIM-configured accepted domain. A non-existent or non-DKIM domain yields this 404 envelope.

Related: GET /exchange/v1.0/dkimSigningConfigs

PATCH /exchange/v1.0/dkimSigningConfigs/{key}

Partial update of the dkimSigningConfigs at /dkimSigningConfigs/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).

Backing cmdlet: Set-DkimSigningConfig. Role: MailFlow.ReadWrite (Pro).

Parameter	In	Type	Required	Description
adminDisplayName	body
bodyCanonicalization	body
enabled	body
headerCanonicalization	body
publishTxtRecords	body	boolean (switch)
dryRun	query	bool (switch)

Update DKIM signing configuration

Partial update of a DKIM signing configuration via Set-DkimSigningConfig. Only the body fields supplied are passed to the cmdlet; the post-Set entity is returned.

PATCH /exchange/v1.0/dkimSigningConfigs/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "enabled": false,
  "adminDisplayName": "exonaut-sample-dkimSigningConfigs"
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "contoso.com",
  "Identity": "contoso.com",
  "domainName": "contoso.com",
  "enabled": false,
  "adminDisplayName": "exonaut-sample-dkimSigningConfigs"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/dkimSigningConfigs

DELETE /exchange/v1.0/dkimSigningConfigs/{key}

DELETE /dkimSigningConfigs/{key}. Use ?force=true to skip EXO’s confirmation guard (Remove-DkimSigningConfig -Force).

Backing cmdlet: Remove-DkimSigningConfig. Role: MailFlow.ReadWrite (Pro).

Parameter	In	Type	Required	Description
force	query	bool (switch)
dryRun	query	bool (switch)

Remove a DKIM signing configuration

Removes the DKIM signing configuration identified by {key} (the domain name) via Remove-DkimSigningConfig. Use ?force=true to skip EXO’s confirmation guard. Returns 204 No Content.

DELETE /exchange/v1.0/dkimSigningConfigs/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/dkimSigningConfigs

POST /exchange/v1.0/dkimSigningConfigs/{key}/rotate

POST /dkimSigningConfigs/{key}/rotate - bound action that rotates the DKIM keypair via Rotate-DkimSigningConfig. Optional ?keySize=1024|2048 overrides the default. No body. Returns 204.

Backing cmdlet: Rotate-DkimSigningConfig. Role: MailFlow.ReadWrite (Pro).

Parameter	In	Type	Required	Description
keySize	query	int		Override DKIM key size: 1024 or 2048
dryRun	query	bool (switch)

Rotate the DKIM keypair

Sub-resource of the DKIM signing configuration at GET /dkimSigningConfigs/{key} - bound action that rotates the DKIM keypair via Rotate-DkimSigningConfig. Optional ?keySize=1024|2048 overrides the default. No request body. Returns 204 No Content.

POST /exchange/v1.0/dkimSigningConfigs/{key}/rotate?keySize=2048 HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/dkimSigningConfigs

?dryRun=true previews of any write stay on Community.