DKIM key rotation is the practice of retiring an old DKIM signing keypair and bringing a new one into service. Each DKIM key has a public half published in DNS as a TXT record at selector._domainkey.example.com, while the private half lives on the signing mail server. Over time a private key can be exposed, weakened, or simply grow stale, so rotating it limits how long a leaked key remains useful to an attacker.
Rotation matters because a compromised private key lets anyone forge messages that pass DKIM for your domain, which in turn can satisfy DMARC alignment. Shorter-lived keys reduce that window. It is also the moment to move from a weak 1024-bit key to the recommended 2048-bit RSA key, or to an ed25519 key.
The safe method overlaps selectors: publish the new public key under a fresh selector, switch the signer to it, confirm new mail verifies, then leave the old selector in place long enough for in-flight mail to clear before removing it. Setting an empty p= value revokes a key. Our done-for-you service rotates keys for you and keeps each selector published until it is safe to retire. Verify a published key with a DKIM checker.
Check it on your domain
- DKIM Checker: look up and validate a DKIM public key by selector.
- DKIM Generator: generate a DKIM key pair and DNS record in your browser.