DKIM key rotation
Replacing a DKIM signing key by overlapping old and new selectors, so receivers can verify mail throughout the change.
See it
What it is
DKIM key rotation replaces a signing key by introducing a new selector instead of overwriting the key currently in use. Publish the new public key, wait until DNS can answer for it, switch the signer to the new selector and private key, then keep the old public key available while delayed and forwarded messages may still carry old signatures.
Reach for it on a schedule, when a vendor recommends a rollover, or immediately after suspected private-key exposure. Separate selectors make the change safe because receivers can verify old and new signatures during the overlap. Amazon SES Easy DKIM and other services that hand you CNAME records rotate the keys behind those targets themselves, so confirm who owns the rotation before editing DNS.
Two moves break mail here: switching the signer before the new record has propagated or deleting the old record the same afternoon. Either move creates signatures receivers cannot verify. DKIM keys have no automatic calendar expiry in DNS, so rotation only happens when someone runs the process, records which selector is active, and removes retired private keys from every signer.
Ask AI for it
Write a zero-downtime DKIM key rotation runbook for OpenDKIM signing mail as example.com. Generate a new 2048-bit RSA key under a fresh selector without overwriting the active selector, show the new TXT record at '<new>._domainkey.example.com', and identify the exact KeyTable and SigningTable changes from the OpenDKIM configuration I paste. Order the rollout as publish, verify with 'dig TXT', wait at least the previous DNS TTL, switch signing, send a test message, confirm the new 's=' value and 'dkim=pass' in Gmail Show original, hold an overlap for delayed mail, then remove the old public and private keys. Include an immediate-compromise path that stops use of the exposed key without pretending cached DNS disappears instantly.