# Fix email authentication for skype.com

You are working on the DNS and mail configuration for skype.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade B (75/100).
Report: https://www.mailauthwatch.com/check/skype.com

## What is published right now (do not assume anything else)
- SPF (TXT skype.com): v=spf1 include:_spf-ssg-a.microsoft.com ip4:91.190.218.48 ip4:91.190.216.100 -all   — valid, 2 of 10 lookups
- DMARC (TXT _dmarc.skype.com): v=DMARC1; p=reject; pct=100; rua=mailto:rua@dmarc.microsoft,mailto:skype@rua.netcraft.com; fo=1; ruf=mailto:rua@dmarc.microsoft,mailto:skype@ruf.netcraft.com;
- DKIM: no key found under 79 common selectors
- MX: skype-com.mail.protection.outlook.com  → Microsoft 365
- Nameservers: ns1-205.azure-dns.com, ns2-205.azure-dns.net …  → records are managed in Azure DNS

## Tasks, in order of impact
### 1. No DKIM key found under 79 common selectors.
Why: Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.
Add CNAME record:
  selector1._domainkey.skype.com  CNAME  selector1-skype-com._domainkey.<tenant>.onmicrosoft.com   (value comes from the provider step below)
Add CNAME record:
  selector2._domainkey.skype.com  CNAME  selector2-skype-com._domainkey.<tenant>.onmicrosoft.com   (value comes from the provider step below)
Microsoft 365 Defender → Email & collaboration → Policies & rules → Threat policies → DKIM → select the domain → Create DKIM keys.
Publish the two CNAME records it shows, then return and turn signing on.
Where: Azure portal → DNS zones → the zone → Record sets.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Azure DNS or Microsoft 365, stop and say exactly what access you need.

## Verify
  dig +short CNAME selector1._domainkey.skype.com
  dig +short CNAME selector2._domainkey.skype.com
  dig +short TXT skype.com
  dig +short TXT _dmarc.skype.com
Then open https://www.mailauthwatch.com/check/skype.com?fresh=1 and confirm:
  DKIM found. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.