What happens when you change ESPs — how to migrate DKIM?

DKIM keys are tied to the ESP that generates them, not to your domain. When you switch platforms, you can't copy old keys over. Your new ESP generates a new keypair, you publish the public key in DNS, and you run both setups simultaneously while moving traffic across. Here's the safe way to do it.

Step 1: Set up DKIM in your new ESP first

Before moving any volume, configure DKIM in the new platform. Your new ESP will give you a selector name and a public key to publish. Add it to DNS as a TXT record at selector._domainkey.yourdomain.com. Verify it's live with our DKIM checker before touching anything else.

Step 2: Keep your old DKIM selector in DNS

And don\'t remove the old selector record yet. Mail still flowing through your old ESP is signed with the old private key. Remove the old DNS record and those messages fail DKIM verification mid-migration. Both selectors coexist in DNS without conflict, so there's no reason to rush the cleanup.

Step 3: Move volume gradually

Shift traffic to the new platform in stages. Maybe 10% first, then check headers to confirm DKIM is passing, then 50%, then 100%. A few days is usually enough. Rushing the cutover is how you end up with authentication failures across your full list.

Step 4: Confirm authentication on the new platform

Send a test email through the new ESP to a Gmail or Outlook account you control. Open the original message source and check Authentication-Results. You want dkim=pass with the new selector name showing. Our email header analyzer parses this for you if raw headers feel tedious.

Step 5: Remove the old selector

Once all sending has moved and DKIM is passing on the new platform, delete the old selector TXT record from DNS. Give it a week after full cutover just to be safe. Any mail in transit when you delete it will fail verification.

If something breaks mid-migration, the SOS hotline is free.