How often should I rotate DKIM keys?

Most security guidance recommends rotating DKIM keys every 6 to 12 months. That's a reasonable baseline for most senders. High-security environments (financial services, healthcare, anything with elevated fraud risk) often go shorter: 90 days is common.

What rotation actually means: You generate a new private key, publish its matching public key in DNS under a new selector, update your mail server to start signing with the new private key, and then remove the old selector from DNS after confirming everything is working. The overlap period (new key published, old key still in DNS) is intentional: you want to make sure messages signed with the new key are being accepted before you pull the old one.

Why bother? Over time, private keys become a risk if they're ever exposed, leaked, or cryptographically weakened. Rotating reduces the window of exposure. Even if you have no evidence of compromise, regular rotation is defense in depth.

If you're using an ESP, many of them handle key rotation automatically. Check your ESP's documentation to confirm whether they rotate keys on your behalf and at what interval.

If you manage your own mail infrastructure, the rotation process is manual. The steps are:

1. Generate a new key pair (private + public)
2. Publish the new public key in DNS under a new selector
3. Configure your mail server to sign outgoing mail with the new private key
4. Verify the new DKIM signature is valid (use our free DKIM checker or check headers on a test send)
5. Remove the old selector from DNS

And don\'t remove the old selector before step 4. Some messages may still be in transit signed with the old key, and receiving servers that haven't cached your new key yet may need to verify against the old one for a day or two.

For context on the key types themselves, see what key length to use. If you're using 1024-bit keys, rotation is also a good time to upgrade to 2048-bit.