Domain registration
In the Microsoft Defender portal or classic Exchange admin experiences, register the domain for DKIM and note the CNAME targets Microsoft provides.
DNS publishing
Create the exact hostnames and targets Microsoft lists—typos here break verification.
Testing
Send messages through Microsoft 365 and inspect authentication headers on received copies from a mailbox that shows full headers.