Proofpoint DKIM setup: outbound signing and DNS verification

Proofpoint DKIM setup is not a copy-and-paste universal DNS value. The selector and public key depend on your Proofpoint tenant, product, and outbound configuration.

Proofpoint’s current Microsoft 365 integration documentation says not to enable the outbound connector until the Proofpoint SPF change is complete and a DKIM key is created and verified. We checked this guidance in August 2026.

The selector and DNS value remain tenant-specific. Confirm the outbound route, create or request the key in Proofpoint, publish the value it provides, and verify a delivered message.

We commonly see Microsoft 365 DKIM tested before Proofpoint is added to the outbound route. That proves the upstream message. It does not prove the signature survives the final Proofpoint hop.

Before you start

First confirm mail flow.

Proofpoint may be used for:

• Inbound filtering only.
• Outbound relay only.
• Both inbound and outbound.
• Microsoft 365 or Google Workspace integration.

DKIM signing matters only for outbound mail. If Microsoft 365 signs before Proofpoint and Proofpoint does not alter the message, Microsoft DKIM may be enough. If Proofpoint modifies or relays outbound mail, you need to test whether DKIM still passes after the Proofpoint hop.

Step 1: identify the signing point

Decide which platform should sign each message stream:

• Microsoft 365 DKIM for Microsoft mailbox mail.
• Google Workspace DKIM for Gmail mail.
• Proofpoint DKIM for mail that Proofpoint signs or modifies.

Avoid blindly enabling every possible signer. Multiple DKIM signatures are allowed, but you need at least one aligned signature that survives delivery.

Step 2: get Proofpoint’s DKIM selector and record

In your Proofpoint admin area, reseller portal, or support ticket, request DKIM signing for your sending domain.

You need:

• The selector, for example a value used before ._domainkey.
• The DNS record type, usually TXT or CNAME depending on the product configuration.
• The host name.
• The full public key or target value.
• Confirmation that signing is enabled after DNS validates.

Do not invent a selector. Do not copy another customer’s DNS record.

Step 3: publish the DNS record

At your DNS provider, add the record Proofpoint gives you.

For a TXT-style DKIM record, the host usually looks like:

selector._domainkey

The value usually begins with:

v=DKIM1; k=rsa; p=...

For a CNAME-style setup, Proofpoint will provide a host and a target. Publish the exact values.

Step 4: enable or confirm signing

After DNS is live, return to Proofpoint and enable signing or ask Proofpoint support to confirm it is enabled.

Do not stop at DNS. DKIM needs both sides: the public DNS key and the private signing configuration in Proofpoint.

Step 5: verify DMARC alignment

Send a test message through the exact outbound route you use in production.

Inspect the message headers:

• DKIM should pass.
• At least one DKIM d= domain should align with the visible From domain.
• SPF should pass if Proofpoint is also in your SPF record.
• DMARC should pass.

Proofpoint selectors are tenant-specific, so if nobody wrote down the one your account uses, you cannot look the key up directly. Our DKIM checker works around that by fingerprinting your provider and probing the selector names providers commonly use, which usually surfaces the live key without a ticket to your Proofpoint administrator.

Then check your domain with DMARCTrust and watch DMARC aggregate reports in your dashboard.

Common mistakes

Configuring DKIM for inbound-only Proofpoint. DKIM signing is an outbound concern.

Publishing DNS but not enabling signing. The public key alone does nothing.

Letting footers break upstream DKIM. If Proofpoint adds disclaimers or rewrites content after Microsoft or Google signs, the original DKIM signature can fail.

Using SPF as the only control. SPF can pass but not align. DKIM is often the safer path for DMARC.

Related SPF setup

If Proofpoint sends outbound mail, add the tenant value shown in Proofpoint Connection Details to your SPF record. See Proofpoint SPF setup.

After SPF and DKIM are configured, build your _dmarc TXT record and publish it with reporting:

v=DMARC1; p=none; rua=mailto:[email protected];

Use DMARCTrust to identify whether Proofpoint mail is passing authentication before you enforce.

FAQ

What is the Proofpoint DKIM selector?

It is tenant-specific. Get it from Proofpoint admin settings or support.

Does Proofpoint DKIM replace Microsoft 365 DKIM?

Not necessarily. If Microsoft signs and Proofpoint does not alter the message, Microsoft DKIM can pass. Test real outbound mail to confirm.

How do I verify Proofpoint DKIM?

Send through Proofpoint, inspect headers, and confirm DKIM passes with an aligned d= domain.

How do I set up DMARC with Proofpoint?

First verify an aligned DKIM signature or aligned SPF result on mail delivered through the final Proofpoint hop. Then publish one DMARC TXT record at _dmarc, start with p=none, and review aggregate reports before enforcement.