Email & DNS
DKIM selector rotation: change signing keys without breaking verification
A DKIM selector identifies which public key a receiver should fetch for a signed message. Selector rotation lets you replace keys without an all-at-once cutover: new mail can start using a new selector while the old public key remains available long enough for delayed messages to be verified.
Inventory active selectors and signing systems
Collect samples from each legitimate sender and note the d= signing domain and s= selector. Website mail, CRM, support tools, newsletters, billing platforms, and mailbox hosting may all use different selectors.
Confirm which service owns each DNS record before changing it.
Publish the new key before signing with it
Create the new selector/key in the sending system and publish the corresponding TXT or CNAME record. Query authoritative and recursive DNS to verify the public key is available before the first production message uses it.
Keep selector names unique enough that an old provider record is not accidentally reused.
Switch signing and observe real mail
Enable the new selector on the sender, deliver representative messages to external providers, and verify DKIM pass plus DMARC alignment where expected. Monitor bounces and authentication results through the transition.
Do not remove the old public key immediately; queued mail signed earlier may still arrive later.
Retire old selectors deliberately
After the maximum expected delivery delay and verification window, stop publishing selectors that are no longer used. Keep an inventory so abandoned keys do not accumulate indefinitely.
- Publish new key first.
- Switch signer second.
- Observe external verification.
- Remove old key after the overlap window.