Broken DKIM key rotation
Key rotation leaves selectors unpublished or mismatched.
Problem summary
Key rotation leaves selectors unpublished or mismatched.
Symptoms
- After rotation, dkim=fail or selector not found
- Old selector removed before all MTAs switched
- New selector published with the wrong key
Possible causes
- Single-selector cutover without overlap
- Stale signer still using retired private key
- DNS TTL left receivers on the old key too briefly or too long without dual publish
How to diagnose
- List active selectors in DNS and which private keys each MTA uses
- Correlate failure start with the rotation change window
How to fix
- Use dual-selector rotation: publish new → sign with new → keep old until traffic drains → remove old
- Restore the previous selector quickly if production breaks
- Sync all signing nodes before removing DNS
How to verify
- All active streams verify on the new selector
- Retired selector removed only after zero signed volume
Prevention
- Written rotation runbook with overlap period
- Never delete the only live selector first
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts