Forum Discussion
Outlook.de DKIM and DMARC records broken
Outbound mail from outlook.de carries a DKIM-Signature with d=OUTLOOK.DE; s=selector1, but the corresponding DNS TXT record at selector1._domainkey.outlook.de does not exist.
This causes receiving servers to report dkim=permerror (no key for signature).
To reproduce:
- Send a mail from any @outlook.de account
- Check the DKIM-Signature header — it references selector1
- Run: dig TXT selector1._domainkey.outlook.de — no record returned
The domain outlook.de also has no DMARC record published (dmarc=none).
Some header information:
Received: by 2002:a05:6a11:e41c:b0:73b:6833:703f with SMTP id em28csp1732536pxc; Tue, 21 Jul 2026 07:23:10 -0700 (PDT)
[...]
ARC-Authentication-Results: i=2; mx.google.com; dkim=permerror (no key for signature) header.i=@OUTLOOK.DE header.s=selector1 header.b=mWWTJtqO; arc=pass (i=1); spf=pass (google.com: domain of email address removed for privacy reasons designates 2a01:111:f403:d20f::3 as permitted sender)
[...]
I leave out DNS this time as the discussion was marked as spam, but you can easily check it yourself:
dig TXT selector1._domainkey.outlook.de
and
dig TXT _dmarc.outlook.de
return no entries as all.
So obviously the DNS records are not published. This leads to bad email reputation - so emails are either in SPAM folders or get rejected completely.
Can someone from MS look into this and fix it. This is at least the case since June 2026 - see also https://borncity.com/blog/2026/07/02/patzt-microsoft-bei-dkim-fuer-outlook-de/ (which is in German unfortunately) - but that is the exact issue.
1 Reply
You’re seeing @outlook.de messages signed with selector1 while DNS returns no public DKIM key, and you also cannot find a DMARC record. Microsoft’s guidance confirms that an absent matching public key produces “no key for signature” and must be corrected by the sender’s domain operator. Because outlook.de is Microsoft-managed, a mailbox owner cannot publish those records or repair this in Outlook.
Repeat both TXT lookups through two independent resolvers, send a fresh test, and save the complete Authentication-Results header plus any nondelivery report. Contact Outlook.com support while signed in and include the UTC send time, Message-ID, selector, receiving domain, and exact lookup results. Ask support to escalate an outbound DKIM/DNS incident for outlook.de. SPF passing does not repair the missing DKIM key, and resetting the Outlook profile will not help. Until Microsoft confirms remediation, re-test delivery rather than assuming all recipient systems will handle the message identically.
