DKIM Key Rotation

DKIM key rotation means generating a new signing key, publishing its public half in DNS under a new selector, switching the mail system to sign with it and later retiring the old one. Selectors let two keys coexist.

Why it matters

A key that never changes gives an attacker who obtains it unlimited time to forge mail that passes authentication. Rotation limits that exposure window. It also forces you to document where signing happens, which finds forgotten senders. Short 512-bit keys are weak, and 1024-bit keys are now widely considered a minimum, with 2048-bit recommended where DNS provider limits allow it.

Example

Rotate from selector s2026a to s2026b:

1. Publish the new public key:

s2026b._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."

1. Switch the signer to selector s2026b.
2. Wait for in-flight mail and delayed deliveries, commonly several days.
3. Remove the s2026a record.

Verify with a test message and check the DKIM-Signature header's s= tag.

Common mistakes

• Deleting the old selector the moment you switch, breaking verification of mail still in transit.
• Forgetting a vendor that signs with its own copy of the key.
• Publishing a record split incorrectly across TXT strings.

Related

• DKIM
• DKIM selector
• Key pair
• Guide: DKIM setup

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.