Look at your DKIM DNS record — the selector name usually encodes rotation. Providers rotate by publishing a new selector (e.g., 20260901._domainkey and 20260401._domainkey) and signing new mail with the newer one. To check rotation on any domain: look up common selectors with the DKIM lookup tool. If multiple selectors return valid keys, rotation is happening. If only one selector has been active for over 12 months, no rotation. Best practice: rotate DKIM keys every 6 months; 2048-bit minimum. Google Workspace, Microsoft 365, and modern ESPs handle rotation automatically; self-hosted setups need a manual process.
All questions
How do I know if my DKIM key is rotating?
Read the full guide
What Is DKIM?
DKIM attaches a cryptographic signature to every email you send. Receiving servers verify the signature against a public key in your DNS — proving the message is authentic and untampered. No DKIM means anyone can forge your brand's email.