Skip to content
SendPoint / Education
Email authentication

DKIM selectors, keys and rotation

Rotate signing keys while preserving verification for mail already in transit.

SendPoint referenceUpdated 2 min read

Separate selector and alignment

A DKIM signature identifies its signing domain with d= and selector with s=. The public key is located using both. A selector chooses a key; DMARC alignment concerns the signing domain and the visible From domain. A descriptive selector name cannot create alignment.

Use supported cryptography

Inspect the real selector

Bash
read -r -p "DKIM d= domain from a real message: " signing_domain
read -r -p "DKIM s= selector from that message: " selector
dig TXT "$selector._domainkey.$signing_domain" +noall +answer
dig CNAME "$selector._domainkey.$signing_domain" +noall +answer

An ESP may delegate a selector through CNAME. Publish the record type and target supplied for your account. A public DNS key does not prove the private key is currently signing messages.

Rotate in stages

  1. Generate or request a new key through the sending platform. Keep private keys in the signing system, never in DNS or documentation.
  2. Publish the new selector and verify resolution before switching the signer.
  3. Enable the new signer and inspect a newly received message for the new selector and a passing signature.
  4. Retain the old public key while messages signed with it can still be queued or retried. Set the retirement interval from your actual queue lifetime and provider instructions.
  5. Remove the retired key only after the overlap is complete. Record the selector, activation time and owner.

Sources