Azure Communication Services DKIM targets do not exist in azurecomm.net DNS

Question

Azure Communication Services DKIM targets do not exist in azurecomm.net DNS

Lukáš Volf 25

We are configuring a verified custom domain for Azure Communication Services Email.

Resource:

events-email-communication-service

Custom domain:

oneavstream.cz

The domain is successfully verified and the SPF record is already configured.

The Azure portal requires these DKIM targets:

selector1-azurecomm-prod-net._domainkey.azurecomm.net

selector2-azurecomm-prod-net._domainkey.azurecomm.net

However, neither target currently resolves in public DNS. Resolve-DnsName returns only the SOA record for azurecomm.net and no record for either requested hostname.

Our authoritative DNS provider, Web4U, therefore refuses to create the CNAME records because the target hostnames do not exist.

Commands used:

Resolve-DnsName selector1-azurecomm-prod-net._domainkey.azurecomm.net

Resolve-DnsName selector2-azurecomm-prod-net._domainkey.azurecomm.net

Please verify whether the DKIM target records were correctly provisioned in the Microsoft-managed azurecomm.net DNS zone.

0 comments

Answer accepted by question author

TP 165.1K Volunteer Moderator

Hi,

It is normal for the DKIM targets not to resolve to A record since they are only used to resolve TXT records. For example, a recipient email server would perform queries equivalent to below:

nslookup -q=txt selector1-azurecomm-prod-net._domainkey.oneavstream.cz
nslookup -q=txt selector2-azurecomm-prod-net._domainkey.oneavstream.cz

With CNAME records in place for your domain, above queries would return correct DKIM records with public keys.

If you are creating/editing DNS records via their web interface, you may want to ask your DNS provider if they have alternative method to edit DNS such as command line, zone file upload, REST API, etc., that wouldn't enforce this restriction on CNAME record.

If your DNS provider will only you to create CNAME if the target FQDN resolves via DNS query, then you will need to switch to different DNS provider (e.g. Azure DNS) in order to use ACS.

IMPORTANT: Azure Communication Services Email (ACS Email) is being RETIRED on September 30, 2028.

Retirement and breaking changes guide for Azure Communication Services - ACS Email

https://learn.microsoft.com/en-us/azure/communication-services/acs-retirement-and-breaking-changes-guide#acs-email

-TP

0 comments

1 additional answer

Your answer

Answer 1

Likely cause: the DNS check is being run against the wrong name. For ACS Email DKIM, you must publish CNAME records under your domain (for example, selector1-azurecomm-prod-net._domainkey.oneavstream.cz), then verify that those CNAMEs exist. Querying the Microsoft target hostnames directly is not the validation step in the ACS troubleshooting flow.

Try this sequence:

In Azure portal, copy DKIM/DKIM2 records exactly from your Email Communication Service domain configuration.
In your DNS zone for oneavstream.cz, create these CNAME records (name/value exactly as shown in portal):
- host/name: selector1-azurecomm-prod-net._domainkey
- host/name: selector2-azurecomm-prod-net._domainkey
Validate the records on your own domain (not on azurecomm.net):
- nslookup -type=CNAME selector1-azurecomm-prod-net._domainkey.oneavstream.cz
- nslookup -type=CNAME selector2-azurecomm-prod-net._domainkey.oneavstream.cz
Wait for DNS propagation and then click Verify again in ACS.
If still failing after propagation, open an Azure support request and include the domain, UTC timestamps, and nslookup output.

Confirmed facts from Microsoft docs:

ACS DKIM troubleshooting checks CNAME records on selector1/selector2-azurecomm-prod-net._domainkey.<yourdomain>.
Verification can fail until DNS propagation is complete.

Notes:

Some DNS providers perform strict target validation in UI; if so, use raw/advanced DNS mode and ensure the portal-provided value is entered exactly (including trailing dot behavior required by your provider).
This is a DNS/authentication setup issue; no tenant-private data is required.

References:

Troubleshoot domain configuration issues (ACS Email): https://learn.microsoft.com/en-us/azure/communication-services/concepts/email/email-domain-configuration-troubleshooting
Add custom verified email domains (ACS Email): https://learn.microsoft.com/en-us/azure/communication-services/quickstarts/email/add-custom-verified-domains

“If you find this answer helpful, please upvote it. If this resolves your issue, please mark it as the accepted answer so that it can help others in the community.”