# Do I need to rotate my DKIM keys?

**NO**—unless a key leaks

> Routine DKIM rotation is security theater for most senders—your ESP manages the keys, and a broken rotation hurts more than a stale key ever did. Compromise is the exception: rotate immediately.

Key rotation is real security hygiene—for credentials humans handle. DKIM keys mostly aren't that, and the rotation advice gets cargo-culted from contexts where it earns its keep into one where it mostly adds risk.

## Why this is a no

- **Your ESP already owns this.** If you send through a platform, [DKIM signing](https://doineed.email/dkim) came with domain setup: the platform generated the keys, holds the private half in infrastructure you never touch, and is the party responsible for their lifecycle. Rotating a key you can't leak has the flavor of changing a password nobody knows.
- **The failure mode is worse than the threat.** Rotation means new DNS records, propagation windows, and selector coordination—and a botched rotation produces failing signatures, which under an [enforcing DMARC policy](https://doineed.email/dmarc-p-reject) means bounced mail. The realistic risk of a stale-but-secret 1024-bit key is far smaller than the realistic risk of a DNS mistake.
- **No deliverability upside.** Providers don't reward key freshness, the same way they [don't reward key length](https://doineed.email/2048-bit-dkim). A valid signature is a valid signature.

## The exceptions that flip it

- **Compromise—rotate immediately.** If a private key is exposed (a leaked server, a departed vendor who had signing access, keys checked into a repo), that's not rotation, that's revocation: publish a new selector, cut over, and null the old key's DNS record.
- **You run your own signing.** [Self-hosted infrastructure](https://doineed.email/my-own-mail-server) means the keys live on machines you patch, and periodic rotation becomes ordinary operational hygiene—industry best-practice guidance suggests a regular cadence precisely because self-managed keys accumulate exposure.
- **DKIM replay concerns.** Spammers occasionally re-send a legitimately signed message at scale to ride the signer's reputation. Rotation helps only after the fact; if replay is a live concern for you, the real mitigations live in signing practices (like header oversigning), not in a calendar reminder.

## The verdict logic

Keys managed by your platform: leave them alone and spend the energy on [the reports](https://doineed.email/dmarc-reports). Keys you manage yourself: schedule rotation like any other credential. Keys that leaked: this page was never the question.

---

- Canonical: https://doineed.email/dkim-rotation
- All questions: https://doineed.email/llms.txt

An opinionated answer from the [Resend](https://resend.com) team.