DKIM Key Rotation Explained: Best Practices, Methods, and Tools
by
Last Updated: 6 min read
DKIM key rotation is the process of replacing your existing DKIM cryptographic keys with new ones to maintain email security. It sounds technical, but the idea is simple: just like passwords shouldn’t stay the same forever, your DKIM keys shouldn’t either.
Regular DKIM key rotation helps prevent email spoofing, phishing, and unauthorized use of your domain. In this guide, we’ll cover what DKIM keys are, why rotation matters, how often you should rotate them, and the safest ways to do it (manually or automatically).
What Are DKIM Keys?
DKIM (DomainKeys Identified Mail) is an email authentication protocol that verifies whether an email truly came from the domain it claims to represent.
When an email is sent, the sending server signs it with a private cryptographic key. A corresponding public key is published in DNS as a TXT record. When the recipient’s mail server receives the message, it retrieves the public key from DNS and uses it to validate the signature. If the signature matches, the message is confirmed as authentic and untampered.
This process strengthens trust between sending and receiving servers. It also improves inbox placement and protects domains from being impersonated. DKIM works alongside SPF and DMARC, forming a layered defense against spoofing and phishing.
But cryptographic protection isn’t a one-time configuration that you can just forget. Keys must evolve too.
Why Rotating DKIM Keys Is Crucial
DKIM key rotation means generating a new private/public key pair and retiring the old one after a safe transition period. But why is this important? Well if a malicious actor gains access to your private key, they can sign fraudulent emails that appear legitimate. That can lead to:
- Phishing campaigns from your domain
- Brand impersonation
- Email blacklisting
- Deliverability damage
The longer a key remains active, the greater the exposure risk. Even if the key isn’t compromised, long-term reuse increases your attack surface. But that’s not all! There’s also an operational reason: outdated keys (such as 1024-bit keys) may no longer meet modern security expectations and can affect authentication reliability. Hence DKIM rotation protects both your brand reputation and your email infrastructure by helping your keys stay modern, updated and airtight.
How Often Should You Rotate DKIM Keys?
There is no single universal rule, but industry best practices suggest:
- Every 6–12 months for most organizations
- Every 3–6 months for high-security or high-volume senders
- Immediately, if compromise is suspected
Organizations aligned with guidance from industry groups such as the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) often adopt annual or biannual rotation policies.
Recommended Key Length
Equally important is key length. A minimum of 2048-bit keys is recommended today. While 1024-bit keys are still technically supported in some systems, they are increasingly considered weak. Upgrading to 2048-bit keys strengthens cryptographic resilience and aligns with modern standards.
Methods of DKIM Key Rotation
There are several ways to rotate DKIM keys, depending on your infrastructure and level of control.
1. Manual DKIM key rotation
You can manually rotate your DKIM keys from time to time by creating new keys for your domain. To do so follow these steps:
- Head over to our free DKIM record generator tool
- Enter your domain’s information and enter the desired DKIM selector of your choice
- Hit the “Generate” button
- Copy your brand new pair of DKIM keys
- The public key is to be published on your DNS, replacing your previous record
- The private key is to be either shared with your ESP (if you’re outsourcing your emails) or uploaded on your email server (if you handle email transfer on-premise)
2. Subdomain DKIM key delegation
Domain owners can outsource DKIM key rotation by allowing a third party to handle it for them. This is when the owner of the domain delegates a dedicated subdomain to an email vendor and asks them to generate a DKIM key pair on their behalf. This allows owners to evade the hassle of DKIM key rotation by outsourcing the responsibility to a third party.
This however can cause policy override problems with DMARC entries. It is recommended that rotated keys are monitored and reviewed by domain controllers to ensure smooth and error-free deployment.
3. DKIM CNAME key delegation
CNAME stands for canonical name, and are DNS records that are used to point to data of an external domain. CNAME delegation allows domain owners to point to DKIM record information that is maintained by any external third party. This is similar to subdomain delegation since the domain owner is only required to publish a few CNAME records on their DNS, while the DKIM infrastructure and DKIM key rotation are then handled by the third party that the record points to.
For example,
“domain.com” is the domain from which originating emails are to be signed, and “third-party.com” is the vendor who will handle the signing process.
s1._domainkey.domain.com CNAME s1.domain.com.third-party.com
The above-mentioned CNAME record needs to be published in the DNS of the domain owner.
Now, s1.domain.com.third-party.com already has a DKIM record published on its DNS which can be: s1.domain.com.third-party.com TXT “v=DKIM1; p=MIG89hdg599….”
This information will be used to sign emails originating from domain.com.
Note: You need to publish multiple DKIM records (recommended: at least 3 CNAME records) with different selectors on your DNS to enable DKIM key rotation. This will allow your vendor to switch between keys while signing and provide them with alternative options.
4. Automatic DKIM key rotation
Most email vendors and third-party email service providers enable automatic DKIM key rotation for customers. For example, if you are using Office 365 for routing your emails, you will be happy to know that Microsoft supports automatic DKIM key rotation for their Office 365 users.
We have covered a full document on how to enable DKIM key rotation for your Office 365 emails on our knowledge base.
Best Practices for DKIM Key Rotation
Here’s a quick checklist to follow:
- Use 2048-bit keys minimum
- Rotate every 6–12 months
- Use multiple selectors
- Maintain a rotation log
- Test new keys before removing old ones
- Allow a grace period during transition
- Coordinate with all ESPs and vendors
- Monitor DMARC reports after rotation
Common Pitfalls & How to Avoid Them
Even experienced teams make mistakes. Here are common rotation issues:
1. Removing old keys too early
Always allow time for DNS propagation and mail flow completion before deletion. Here, configuring DMARC reports can come in handy. Simple generate a DMARC record and define an “rua” tag with your email address to receive daily reports on your authentication status and results.
2. Skipping verification
Always test your authentication results after enabling a new selector. You can do so manually or preferably with the help of a DKIM checker tool for instant clarity and insights.
3. Not using multiple selectors
Single-selector setups create downtime risk. Make sure you are defining separate selectors for separate DKIM records configured on your domain so receiving servers can locate your keys easily.
4. Misconfigured delegation
Incorrect CNAME or subdomain records can break DKIM alignment, so make sure you are verifying your configuration every time you make changes.
5. Ignoring key size
Outdated 1024-bit keys weaken security posture. Experts recommend to configure at least 2048-bit DKIM keys for enhanced protection, and to comply with modern security standards.
Deploying a DKIM Key Rotation Strategy
We call it the 3 Ds of DKIM key rotation:
Step 1. Discuss: Align with stakeholders and vendors on your rotation frequency, key size (2048-bit recommended) and delegation method.
Step 2. Decide: Now Choose your rotation model: Manual, CNAME delegation, subdomain delegation or fully automated
Step 3. Deploy: Finally, Implement safely by generating new selector, monitor your authentication and only remove old keys after validation.
Example Rotation Schedule
January: Add new selector and key
February: Switch signing to new selector
Mid-February: Remove old key
Repeat every 6–12 months
Summing Up
DKIM key rotation is a critical but often overlooked component of email security. Leaving keys unchanged for years increases exposure risk and weakens your authentication framework. To sum up, rotating keys every 6–12 months, using 2048-bit encryption, maintaining multiple selectors, and monitoring authentication results form the foundation of a strong rotation strategy.
To make your DKIM key rotation and authentication easy, PowerDMARC can help! Our team of experts has helped 10,000+ organizations automate protocol setup and management, with zero guesswork or downtime. Contact us today to learn more or get started!
Frequently Asked Questions
1. Does DKIM key rotation require downtime?
No. DKIM key rotation should not cause downtime if implemented correctly. By introducing a new selector while keeping the old key active during a grace period, emails continue to authenticate normally throughout the transition.
2. Should I rotate DKIM keys for all sending sources at the same time?
Not necessarily. If you use multiple email service providers or internal mail servers, each source may have its own DKIM configuration. Rotation should be coordinated per sending source to avoid authentication misalignment.
3. How long should I keep the old DKIM key after rotating?
It’s generally recommended to keep the old key published for at least 1–2 weeks after switching to a new selector. This accounts for DNS propagation delays and queued emails that may still reference the previous signature.
4. Can DKIM keys expire automatically?
DKIM keys do not technically expire unless you configure them to. DNS records remain active until manually removed or replaced.
5. Is DKIM key rotation required for DMARC compliance?
DMARC does not explicitly require DKIM key rotation. However, regular rotation strengthens overall email authentication and reduces the risk of DKIM alignment failures caused by compromised or outdated keys.
Domain & Email Security Expert at PowerDMARC
Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.
Latest posts by Yunes Tarada (see all)
