What is DKIM Key Rotation?

Changing passwords periodically is vital if you keep an online presence across different platforms. You know the drill. To keep all accounts safe, you must update your passwords every three months. The same rule applies to your DKIM signature. You need to rotate DKIM keys periodically if you’re a domain holder. 

But first: What is DKIM? DKIM or DomainKeys Identified Mail is one of the main components of DMARC authentication. It’s an authentication protocol that uses a digital signature in the form of an encrypted identifier attached to all your messages. This signature is generated using a private key.

The sender’s inbox service verifies the signature by retrieving the public key from the domain’s DKIM record to ensure the message was, in fact, sent from your domain. The whole process proves your emails haven’t been tampered with mid-traffic.

When you rotate DKIM keys, you simply replace the old private/public key pair used to authenticate all your messages with a new one. It’s best to do this with the same frequency as you would with passwords because DKIM keys can be compromised. 

What do rotating DKIM keys do? Well, essentially it keeps your online security updated and your domain safe. If a bad actor steals or deciphers your private key, they can sign their spam, spoof, or phishing emails with your DKIM signature. This compromises your recipients, your domain reputation, and your overall business.

Hardening Your Email Security: Why is DKIM Key Rotation Important?

When you create a DKIM record, half the information is public to prying eyes on the internet. This makes DKIM an easy target. Even with state-of-the-art encryption, all DKIM keys are vulnerable. Any hacker can crack them with enough time and computer power. You keep malicious actors at bay when you rotate old DKIM keys with new ones.

DKIM key rotation is a valuable practice to ensure the best performance of your website’s defenses. Whenever you change your DKIM keys, you share institutional knowledge about how your domain’s defenses work. This helps and supports the following:

• Cross-department effectiveness: The people managing your DNS and your email operations can get on the same page about email security practices. 
• Cross-vendor effectiveness: If you rely on an ESP to send your messages on your behalf, this will give them more insight into your communication routines. They can better optimize their security updates and change the DKIM keys based on your performance as a sender in the long run.
• Conformance: Frequent DKIM key rotation nurtures advance planning in implementing best cybersecurity practices. The procedure can be classified as standard, making it more accessible instead of labeling each change as an emergency, which usually brings more complications.
• Automation: The process of rotating DKIM keys can be handled manually, but frequent rotations require tools to optimize the process. Automation tasks can handle the generation of new DKIM keys, helping you save time with a lower rate of mistakes. 
• Redundancy and bench depth: With more people involved in the process of rotating DKIM keys, you reduce the reliance on just a few individuals in your team to handle the change. This minimizes the risks of infrequency since more people are involved with the security of your domain.

DKIM Key Rotation Methods

You have a few options to rotate DKIM keys for your domain. You can go the manual route using a certifiable tool, like EasyDMARC’s DKIM record generator tool. You can also go for subdomain delegation and have a third party take care of it, or you can opt for CNAME key delegation. The latest option works similarly to the second one. It requires a bit of tinkering with your CNAME records. We fill you in with all the details below:

Manual

You can rotate DKIM keys for your domain manually by simply creating and adding a DKIM record to your DNS. Make sure to configure your email server with the private key and then publish the public key in your DKIM record. 

After finishing the setup, the sync process between email servers and your DKIM keys can take a while. Once they’re up and running, you need to evaluate the coordination of your systems and processes to ensure everything is in working order. Manual DKIM key rotation can be quite technical, making it the least desirable option.

Subdomain Delegation

If you wish to handle DKIM key rotation most efficiently, subdomain delegation is a  popular choice. You don’t need to manage your DKIM infrastructure here. Instead, you delegate control of dedicated email sending subdomains to a third party Going this route means you’re outsourcing DKIM key rotation. While there’s less hassle on your side, you still need to monitor and review the process to ensure error-free deployment and alignment with other protocols like DMARC..

CNAME

CNAME delegation gives you the option, as domain owner, to outsource DKIM key rotation to a third party using CNAME DNS records. You can authorize someone to create all your DKIM signatures and upgrade them based on specific frequencies set by you. 

The third party will be held accountable for DKIM signatures, and you can de-authorize them by simply removing the CNAME records. The only disadvantage of this rotation method is that you need multiple CNAME-based DKIM keys already configured for the vendor to rotate.

DKIM Key Rotation Best Practices

Most DKIM key rotation best practices involve timing and the methods used to change DKIM keys. We can summarize these in a brief list:

• Avoid manual DKIM rotation.
• Opt for automation as it’s fast and effective, saving you the technical hassle of rotating DKIM keys.
• If you’re using a third-party service, make sure they spend the right amount of time tracking, troubleshooting, and fixing all configuration errors.

Why Choose Automatic DKIM Key Rotation?

If you’re willing to rotate DKIM keys manually, you need a tool to generate the new DKIM key. After that, you’ll have to copy and paste large coding strings into your domain management software. This leaves your domain open to the horrors of human error since you still have to handle all the logistics related to coordination with email service providers (ESPs). 

With automatic DKIM rotation, you have an email provider taking care of all your needs regarding DKIM security. Most ESPs have tools in place to track down your data and coordinate your DKIM configuration with other email services. Microsoft 365 and SendGrid are known for their automation tools that help keep your communication flow safe and steady. 

If you’re not sure whether you have any DKIM records on your domain, use our free DKIM lookup tool to find out quickly.

How Often Should You Rotate DKIM Keys?

The frequency of rotating DKIM keys is determined by the length of the keys used by the website. 1024-bit keys need to be rotated every three months or so, while you can typically rotate 2048-bit keys every six months. The Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG) has published guidelines recommending the best DKIM key rotation practices.

This is a summary of their conclusions: 

• Low-risk senders, such as local organizations and local or regional brands, only need to rotate DKIM keys every six months or once a year at most.
• High-risk senders, such as global brands, government agencies, online stores, banking services, and others, must rotate DKIM keys monthly.

M3AAWG also recommends rotating your DKIM keys to detect a security breach of any kind, regardless of schedule. This will keep your data safe, and your domain authenticated.

Final Thoughts

You need to rotate DKIM keys with the same frequency as you need to change passwords. Doing so reinforces your domain’s security and prevents it from being exposed to malicious actors online. Running this security measure is required since DKIM keys have a public side that can be tampered with to spoof your website. 

The last thing you need as a business owner with a solid online presence is to have someone disrupt your operations. Hackers can use this information to impersonate you and steal the data of your customers and business partners. Keep in mind that no precaution is too small regarding your website’s security. 

Find out how to become a trusted sender by authenticating your domain using DMARC. Feel free to reach out and improve your security now! At EasyDMARC, we’re more than happy to help you get started.