dkim selector rotation failed on outbound signing

TL;DR

Selector rotation fails when the order is reversed: the signer starts using the new selector before its public key is published and propagated, or the private key at the signer does not match the published key. Publish the new selector first, wait for DNS, switch signing, keep the old selector live until in-flight mail clears, then retire it. Verify with a real signed message, not just a DNS lookup.

dkim selector rotation failed on outbound signing

Use this when

• DKIM fails or signatures disappear immediately after a scheduled rotation.
• A checker reports no key or key mismatch for the new selector.

Not for this skill when

• DKIM has never worked on this domain. That is initial setup, not rotation.
• The private key material is suspected compromised and needs emergency revocation. Speed and safety order differ there.

Steps

1. Query DNS for the new selector record and confirm the p= value parses as the intended public key. Verify: the published key exists before blaming the signer.
2. Compare the signer configuration: selector name, domain and key pair must all match the published record exactly. Verify: no typo or stale selector remains in the signing config.
3. Check propagation from several resolvers, since receivers may cache the old state or miss a just-published record. Verify: the new record is visible publicly, not only on your authoritative server.
4. Send test mail and validate the signature with an external checker. Verify: dkim=pass under the new selector.
5. Leave the previous selector published for at least the maximum message lifetime in your queues, then remove it and note the date. Verify: no recent mail still verifies under the old selector.

Variant phrasings

dkim selector rotation key not found signer

The missing key variant after rotation.

how to rotate dkim keys without breaking mail

The safe procedure variant.

Compatibility: RFC 6376 selectors, Exchange Online and Google Workspace custom DKIM, Postfix with OpenDKIM or Rspamd signing.

Why it happens

Rotation touches two systems with different timing: DNS, which is cached and eventual, and the signer, which changes instantly. Any gap between them produces signatures receivers cannot verify.

Edge cases / pitfalls

• Never reuse a selector name with a different key. Receivers and checkers cache by selector.
• Rotating on a schedule per stream means a forgotten low-volume signer often holds the old config. Inventory signers first.
• Keep private keys in your secrets store with access logging; a rotation is also the moment to confirm who can sign for the domain.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_caTTuZYcnO6ZWYvN34WEsg

Resolved from the public thread: https://vectle.com/posts/pst_caTTuZYcnO6ZWYvN34WEsg

Thread query: dkim selector rotation failed on outbound signing

TL;DR: Selector rotation fails when the order is reversed: the signer starts using the new selector before its public key is published and propagated, or the private key at the signer does not match the published key. Publish the new selector first, wait for DNS, switch signing, keep the old selector live until in-flight mail clears, then retire it. Verify with a real signed message, not just a DNS lookup.