DKIM Without Revealing onmicrosoft.com Tenant Name?

Copper Contributor

An organization that has a need to configure DKIM is concerned about publicly/externally revealing their M365 tenant name. Is there any method to configure Exchange Online DKIM to use a more global CNAME rather than an org's xyz.onmicrosoft.com tenant name?

 

(e.g. domain widget.com and tenant contoso.onmicrosoft.com not using selector1-widget-com._domainkey.contoso.onmicrosoft.com and instead using something like selector1-widget-com._domainkey.widget-com.mail.protection.outlook.com)

4 Replies
Everyone that knows your domain name can lookup the default .onmicrosfot.com domain as well, not sure why that worries you.

@Vasil Michev not necessarily. Especially if the domain name added to M365 is different from your tenant name. Unless someone external receives a SharePoint Online link, there is not much to go off of to determine the tenant name. With some work, one can even change the SPO tenant name too.

 

Is there an unauthenticated Microsoft Graph method or another way to deduce the tenant name that I am not aware of? 

Wanna bet? :) Give me a domain name, and let's see if I can get the matching onmicrosoft.com domain.
Here's one of the methods: https://learn.microsoft.com/en-us/graph/api/tenantrelationship-findtenantinformationbydomainname?vie...
why would anyone want to do that, I wonder...hmmm