What Is DKIM key rotation?

Replacing a signing identity's key

A DKIM signer uses a private key, while receivers find the corresponding public key through the signing domain and selector. Rotation changes that key material under a controlled procedure. Providers may manage the process or expose specific activation steps. The selector is a lookup identifier, so changing a displayed selector without coordinating the actual signer and DNS is not a complete rotation.

A transition usually requires overlap. Publish the new verification data before switching the signer, and account for DNS caching and messages already in transit before removing old data. The right timing depends on the mail system and provider's documented behavior. A universal instruction to delete the old key immediately can make legitimate older messages fail verification.

Test the change at both ends

Before activation, capture the current selector and a passing received example. After activation, send another controlled message and inspect which selector the signer actually used. Query the relevant public DNS name and confirm a trusted receiver verifies the new signature. A saved record in the DNS editor is not proof that the sending service has begun using the corresponding private key.

Recovery and ownership

Keep the change owner, provider instructions, activation time and rollback path together. If verification fails, distinguish a missing key, wrong selector, malformed publication and changed message content. Reverting a DNS record while the signer still uses the new private key may make matters worse, so recovery needs to coordinate both sides.

Rotation is maintenance rather than an inbox-placement technique. It can reduce exposure from long-lived key material, but it does not repair poor contact data or an unwanted message. Preserve necessary verification overlap and document the final active configuration so the next operator can explain which key was used for a particular message and when.