DKIM Selectors and Key Rotation
Rotate DKIM keys safely with selectors, DNS propagation windows, and alignment checks for transactional email.
TL;DR
A DKIM selector lets a domain publish more than one signing key. Rotate safely by publishing the new selector first, verifying receivers can fetch it, switching signing, waiting out mail and DNS caches, then removing the old selector.
What you will learn
- Understand DKIM selector DNS names
- Rotate signing keys without breaking delivery
- Check DKIM and DMARC alignment after rotation
How selectors work
DKIM signs a message with a private key and tells receivers where to find the public key in the DKIM-Signature header.
Example header fields:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=ps2026; ...
The receiver looks up:
ps2026._domainkey.example.com TXT
The s= value is the selector. The d= value is the signing domain.
Why rotate keys
Rotate DKIM keys when:
- A private key may have been exposed.
- A provider migration changes signing infrastructure.
- Your security policy requires periodic key rotation.
- A key is too weak for current receiver expectations.
- You are decommissioning an old email provider.
DKIM rotation should be planned, not rushed, unless there is an active compromise.
Safe rotation sequence
- Generate the new DKIM key in Postscale.
- Publish the new selector TXT record.
- Wait for DNS propagation and provider verification.
- Send test messages and confirm
dkim=pass. - Switch signing to the new selector.
- Keep the old selector published.
- Wait for queued mail, retries, and DNS caches to age out.
- Remove the old selector.
During provider migration, keep both old-provider and Postscale selectors published until traffic is stable.
Key length
Use 2048-bit RSA where possible. Very old DNS providers can struggle with long TXT records, but modern DNS providers support the split-string format required for longer keys.
If your provider supports Ed25519 DKIM, treat it as an advanced compatibility choice and test carefully. RSA remains the broadest operational baseline.
DMARC alignment
DKIM passing is not enough for DMARC. The DKIM d= domain must align with the visible From domain.
Example:
| From | DKIM d= | DMARC alignment |
|---|---|---|
alerts@example.com | example.com | Pass |
alerts@example.com | mail.example.com | Pass in relaxed alignment |
alerts@example.com | provider.example.net | Fail |
Use DMARC policy and alignment before changing enforcement.
Common mistakes
- Deleting the old selector too early.
- Publishing the selector under the wrong domain.
- Copying a truncated public key.
- Rotating DKIM while also changing SPF and DMARC at the same time.
- Testing only one mailbox provider.
Use the DKIM lookup tool to inspect selectors before sending production traffic.
References
Frequently asked questions
- What is a DKIM selector?
- A selector is the left-hand label before _domainkey. It lets a domain publish multiple DKIM public keys, such as ps2026._domainkey.example.com.
- Can I delete the old DKIM selector immediately?
- No. Wait until old signed mail has aged out and DNS caches have expired, otherwise receivers may be unable to verify messages still in transit.
Related guides
Put the guide into production
Postscale brings sending, inbound processing, DMARC reporting, and masked addresses behind one API so the operational pieces stay connected.