Key rotation is real security hygiene—for credentials humans handle. DKIM keys mostly aren’t that, and the rotation advice gets cargo-culted from contexts where it earns its keep into one where it mostly adds risk.
Why this is a no
- Your ESP already owns this. If you send through a platform, DKIM signing came with domain setup: the platform generated the keys, holds the private half in infrastructure you never touch, and is the party responsible for their lifecycle. Rotating a key you can’t leak has the flavor of changing a password nobody knows.
- The failure mode is worse than the threat. Rotation means new DNS records, propagation windows, and selector coordination—and a botched rotation produces failing signatures, which under an enforcing DMARC policy means bounced mail. The realistic risk of a stale-but-secret 1024-bit key is far smaller than the realistic risk of a DNS mistake.
- No deliverability upside. Providers don’t reward key freshness, the same way they don’t reward key length. A valid signature is a valid signature.
The exceptions that flip it
- Compromise—rotate immediately. If a private key is exposed (a leaked server, a departed vendor who had signing access, keys checked into a repo), that’s not rotation, that’s revocation: publish a new selector, cut over, and null the old key’s DNS record.
- You run your own signing. Self-hosted infrastructure means the keys live on machines you patch, and periodic rotation becomes ordinary operational hygiene—industry best-practice guidance suggests a regular cadence precisely because self-managed keys accumulate exposure.
- DKIM replay concerns. Spammers occasionally re-send a legitimately signed message at scale to ride the signer’s reputation. Rotation helps only after the fact; if replay is a live concern for you, the real mitigations live in signing practices (like header oversigning), not in a calendar reminder.
The verdict logic
Keys managed by your platform: leave them alone and spend the energy on the reports. Keys you manage yourself: schedule rotation like any other credential. Keys that leaked: this page was never the question.