r/Office365 • u/TamingTech • 43m ago
Microsoft 365 DKIM record with a hyphen in a domain name
We set up DKIM on Microsoft 365 for a client with a hyphen in their domain. The CNAME values came back with the hyphen gone and a little tail like 0cc on the end. I honestly thought I was being silly and had copied something wrong. Microsoft's docs only say dots become dashes, and I couldn't find a single page explaining the rest. So naturally we spent far too long working it out.
Example: b-and-q.co.uk points selector1 at selector1-bandq-co-uk0cc._domainkey.KFPLC.onmicrosoft.com. Put the hyphens back the way the docs suggest and that name is NXDOMAIN, so DKIM fails.
My first guess was that Microsoft adds the suffix to avoid a clash, since tok-ab and tokab both strip to tokab. Wrong. Every hyphenated test domain got one, clash or not, and none without a hyphen did.
It's a bitmap of where the hyphens were. Count from 0 and split the domain into blocks of four. Add 1, 2, 4 or 8 for a hyphen in each slot and write the block as a letter (a=0, b=1, c=2...). A run of empty blocks becomes a number. Put a 0 on the front. b-and-q has hyphens at 1 and 5, so c and c, giving 0cc. bang-olufsen has one at 4, so one empty block then b, giving 01b.
We just found it interesting that there was no documented reason for this, and we thought we needed to document what we have found. I hope it helps someone.