All questions
Q & A Email Auth · August 5, 2026

What happens if my DKIM key is compromised?

Remove the public key TXT record from DNS immediately. The compromised key can no longer be used to verify signatures. Generate a new key pair, publish the new public key under a new selector, and reconfigure your mail server to sign with the new private key. This is why key rotation on a schedule (annually or more) is recommended.

Read the full guide
What Is DKIM? How DomainKeys Identified Mail Works
DKIM attaches a cryptographic signature to every email you send. Receiving servers verify the signature against a public key in your DNS — proving the message is authentic and untampered. No DKIM means anyone can forge your brand's email.
Related questions
Can I have multiple DKIM keys for the same domain? Does DKIM prevent spam? How do I add a CNAME for Office 365 Autodiscover? How do I find the DKIM selector for Google Workspace? How do I find the DKIM selector for Microsoft 365?