Definition
DKIM rotation is the practice of periodically replacing the cryptographic keys used to sign a domain's email. Each DKIM key is published in DNS under a selector, and rotating the key means introducing a new selector and key, then retiring the old one after a safe transition period. Rotation limits how long a single compromised key remains usable and is considered good security hygiene for any domain that signs email.
How It Works
A DKIM setup uses a selector such as s1 or 2025q3 to name a specific key pair. The public key lives in DNS, while the private key is held by the signing system. Rotation follows a predictable sequence:
- Generate a new key pair with the desired DKIM bit length, typically 2048 bits.
- Publish the new public key under a new selector, such as
s2. - Configure the sending system to sign with the new selector and key.
- Continue accepting the old key in DNS while mail in transit or delayed signatures may still reference it.
- After a transition period, remove the old selector's DNS record, retiring the old key.
The critical detail is the overlap period. Because email can be delayed or queued, removing an old key immediately can cause valid messages to fail signature verification at the receiver. Keeping both selectors active briefly prevents those failures.
Why Rotation Matters
Long-lived keys are a security risk. If a private key is exposed, an attacker could sign messages that pass email authentication under the victim's domain, making phishing far more convincing. Regular rotation bounds that exposure window.
Rotation also supports operational changes. When moving between email service providers, teams introduce the new provider's selector alongside the old one, preserving DKIM alignment and DMARC compliance throughout the migration.
Best practices for rotation include:
- Rotate on a schedule, commonly annually or quarterly for high-value domains.
- Use unique keys per selector and never reuse retired keys.
- Automate rotation where volume makes manual changes error-prone.
- Verify signature validity after each rotation using a test tool.
Example
A SaaS company rotates its DKIM key quarterly. It publishes a new 2026q1 selector, switches its signing platform to the new key, and leaves the previous 2025q4 selector in DNS for two weeks. After confirming no delayed mail fails verification, it removes the old record.
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Alt Text
Alt text is the written alternative to an image in an email, displayed when images are blocked, slow to load, or consumed by screen readers.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Apple App Password (Email)
An Apple app password is a generated, app-specific password used to sign into an email account through clients that do not support two-factor authentication.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Frequently Asked Questions
There is no universal requirement, but security-conscious senders typically rotate annually or more often. Higher-value or high-volume domains may rotate quarterly. The key is to have a process, not necessarily a rapid cadence.
Any message still signed with the old key but verified after its DNS record is removed will fail DKIM, which can trigger DMARC failures and hurt deliverability. Always keep the old selector published through a transition window.
Not if the new key is signed under a domain that still aligns with the `From:` address. Rotation changes the selector, not the signing domain, so alignment is preserved as long as the signing domain is unchanged.
Technically yes, but it is poor practice. A key that never rotates means a single leak compromises your domain indefinitely. Rotation is a low-cost control that meaningfully reduces risk.