What is DKIM key rotation and why is it important?

DKIM works by having your sending server sign each outgoing email with a private key. The matching public key lives in your DNS, and receiving servers use it to verify the signature. Key rotation is the practice of swapping out that keypair on a regular schedule: generating a new pair, publishing the new public key, updating your sending platform, then retiring the old one.

Why it matters

Long-lived keys are a security risk. If a private key gets leaked or compromised, an attacker could forge perfectly valid DKIM signatures on emails pretending to come from your domain. Receivers would see DKIM: PASS. The longer a key has been in use, the more exposure it's accumulated.

Rotation limits the window. If you rotate every 6 to 12 months, even a compromised key is only useful until the next swap. The email security community generally recommends at least annual rotation. High-volume senders rotate quarterly. (Most senders never rotate at all, which is exactly the problem.)

How rotation works without breaking delivery

The trick is running old and new keys simultaneously during the transition. Don't delete the old record on day one. Emails already in transit are still signed with the old private key and need the old public key in DNS to verify.

1. Generate a new keypair. Your ESP usually has a "rotate DKIM key" or "add selector" option. Self-hosted servers generate the pair with OpenSSL or similar.
2. Publish the new public key in DNS at a new selector name. If you were using selector "s1", publish the new key at "s2".
3. Update your sending platform to sign with the new private key.
4. Wait 48 hours. Let DNS propagate and let any mail signed with the old key clear the queues.
5. Remove the old selector from DNS.

You can check which selectors your domain currently publishes with our DKIM checker. If you're setting up rotation for the first time and want a walkthrough for your specific ESP, the SOS hotline is free.