DKIM signs outgoing email with a private key; receivers fetch the matching public key from DNS to verify it. Keys should be strong and replaced from time to time, and the selector mechanism makes that possible without breaking delivery. This guide explains DKIM selectors, key choices and safe key rotation.
Before you start
- Know which system signs your mail: cPanel (Exim), Plesk, Rspamd/OpenDKIM on your own server, or an external provider.
- Access to your DNS zone.
How selectors work
A DKIM signature contains d=example.com and s=selector. The receiver looks up the public key at:
selector._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjAN..."Because the selector is part of the name, a domain can publish several keys at once – one per sending service (for example default for your server and s1 for a newsletter provider) or old and new keys during rotation.
Choosing a key
| Key | Status | Notes |
|---|---|---|
| RSA 1024-bit | Weak | Replace |
| RSA 2048-bit | Recommended | Widely supported; TXT value must be split into 255-char strings |
| RSA 4096-bit | Rarely needed | Some DNS providers struggle with the size |
| Ed25519 | Modern | Short keys, but not all receivers verify it yet – use alongside RSA |
Check your current key
dig default._domainkey.example.com TXT +shortFind the selector in use by looking at the DKIM-Signature: ... s= header of a message you sent.
Rotate a DKIM key safely
- Generate a new key pair with a new selector, for example
2026a. With OpenDKIM:opendkim-genkey -b 2048 -d example.com -s 2026a; with Rspamd:rspamadm dkim_keygen -s 2026a -d example.com -b 2048. - Publish the new public key at
2026a._domainkey.example.comand wait at least the record's TTL (or a day). - Verify the DNS record with
dig. - Switch signing to the new selector and private key in your mail server config.
- Test: send to a mailbox that shows Authentication-Results; you should see
dkim=pass header.s=2026a. - Keep the old public key published for about a week, so messages still in transit or being re-verified pass.
- Remove the old record (or publish it with an empty
p=to signal revocation).
Warning: Never switch signing to a new key before its public key is live in DNS – every message in between fails DKIM and may fail DMARC.
On control panels
- cPanel: Email → Email Deliverability shows the DKIM record and lets you install it; key management is handled by the server.
- Plesk and DirectAdmin: DKIM is toggled per domain; regenerating keys updates DNS automatically when the panel hosts DNS.
- External DNS: if your DNS is hosted elsewhere (e.g. Cloudflare), copy the new record there before the panel starts using it.
How often to rotate
Many organisations rotate every 6–12 months, and immediately if a private key may have leaked (for example after a server compromise).
FAQ: DKIM keys
Can I have multiple DKIM records?
Yes, with different selectors. Each sending service should have its own.
Why does my DKIM record break in the DNS panel?
2048-bit keys exceed 255 characters; the value must be split into multiple quoted strings or the panel must handle it automatically.
Does rotating DKIM affect SPF or DMARC?
No, as long as signing keeps passing with a key aligned to your From domain.