Hi TIA,
Here is sample of my configuration, the domain provider is CloudFlare.
1. In Authenticated Domain settings, we should add full subdomain.
So you should add 'promo.contoso.com' as domain name field value.

2. In DNS settings:

TXT: promo.contoso.com -> d365mktkey=s1234567(In CF, it will shorten the subdomain to promo.)
CNAME: apjkey1._domainkey.promo -> apjkey1promocontosocom.marketing.dynamics.com
CNAME: apjkey2._domainkey.promo -> apjkey2promocontosocom.marketing.dynamics.com
3. Click Confirm button and test.
Marketing form

Marketing email

In addition,
1. Due to DKIM hosts are fixed, (apjkey1._domainkey and apjkey2._domainkey, If CRM region is APAC.) and they can only have one value(apjkey1promocontosocom.marketing.dynamics.com), so it means that we can only use one domain(root domain or subdomain) in each time.
2. This website is helpful to check whether DKIM was added successfully.
https://mxtoolbox.com/SuperTool.aspx
