DKIM key rotation
Replacing a DKIM signing key with a new one under a new selector, keeping both published until mail signed with the old key has been verified.
What it means
Rotation limits the damage from a stolen or cracked private key and is how a domain moves to a longer key. RFC 6376 describes the method: publish the new public key under a new selector, switch outgoing mail to sign with it, keep the old key published while messages signed with it may still be in transit or queued, then remove it. Removing a record or publishing it with an empty p= revokes the key.
Hosted platforms often automate this. Microsoft 365 uses two CNAME selectors per domain and rotates between them when an admin requests it; providers that ask you to CNAME their selectors can rotate without any DNS change on your side.
Never delete the only published key before signing has moved, or every message in flight fails DKIM.
Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes