Rotate DKIM keys every six months

How to do it

A key that lives for years has more time to leak or be cracked, and a routine makes an emergency change easy. M3AAWG's key rotation practice sets six months as the longest interval. Name selectors by date, such as s2026a. Publish the new public key, wait for its DNS time to live, then switch signing to it. Keep the old record for about 7 days, so messages still in queues and forwarders verify. Then publish the old selector with an empty p=, which RFC 6376 defines as a revoked key. Many sending services rotate their managed keys for you, so check their setting instead. Keep the private key in a secrets store, as Keep secrets in a secrets store says.

Examples

JavaScript example

const MAX_DKIM_KEY_AGE_DAYS = 183;

export function isDkimKeyDue(selector, now = new Date()) {
  const ageDays = (now - new Date(selector.createdAt)) / 86_400_000;
  return ageDays > MAX_DKIM_KEY_AGE_DAYS;
}

Python example

from datetime import datetime, UTC

MAX_DKIM_KEY_AGE_DAYS = 183

def is_dkim_key_due(selector, now: datetime | None = None) -> bool:
    now = now or datetime.now(UTC)
    return (now - selector.created_at).days > MAX_DKIM_KEY_AGE_DAYS

DNS example

s2026a._domainkey.example.com.  3600  IN  TXT  "v=DKIM1; k=rsa; p="

How to check

A scheduled job reads the selector in the last sent message's DKIM-Signature and fails when its key was created more than 183 days ago. dig +short TXT on a retired selector returns p= with no key.

Sources

• M3AAWG DKIM Key Rotation Best Common Practices
• RFC 6376, DomainKeys Identified Mail Signatures, section 3.6.1

Related rules

• EML-10 Sign every message with DKIM in Email
• ENG-26 Keep secrets in a secrets store in Engineering