DKIM Rotation Hell: Why Your Email Still Fails Mid-Migration
Half-completed DKIM rotations break email verification silently. Here's what I learned debugging this in production.
I spent three hours last month tracking down why a client's automated invoices stopped reaching customers mid-DKIM rotation. The mail server was signing with the new key. DNS still published the old one. Everything looked fine from both angles individually. Customers saw nothing but bounces.
The problem: nobody checks the gap between states.
DKIM rotation seems simple—generate new key, update DNS, switch the sender. But there's a window where your mail service and DNS don't agree. If a signature uses the new key but DNS still validates against the old one, verification fails. Some mail providers cache aggressively. Others retry. Your logs show nothing wrong because from each system's perspective, nothing is.
I've seen this in three different setups now. Always during migrations or when teams don't coordinate timing. Always at 2 AM.
What actually works:
-
Keep the old key active while DNS updates propagate. Don't switch signing keys until you confirm DNS everywhere returns the new one. Wait 48 hours minimum.
-
Log the selector being used. When DKIM breaks, you need to know which key signed each message. Add this to your mail logs immediately.
-
Verify both directions. Before declaring rotation complete, manually sign a test message with the new key and verify it against the current DNS record. Then do the reverse with the old key against the old DNS record.
-
Monitor failed signatures, not just bounces. Mail logs show rejections. The real signal is authentication-results headers showing DKIM=fail with a selector mismatch.
I built this check into Seven Suite's deployment pipeline after the first incident. Now rotation requires explicit DNS validation before the service switches keys. Takes an extra five minutes but saves the panic calls.
If you're migrating mail services or rotating credentials, don't assume the transition is atomic. It isn't. Build tooling that forces you to verify both halves before declaring victory.
Your 3 AM self will thank you.