DKIM rotation is one of those email hygiene items that almost nobody touches until a security review or a leaked key forces the issue. The mechanics differ sharply between Amazon SES's two DKIM modes. Easy DKIM uses a 2048-bit RSA key by default and AWS does not auto-rotate it (AWS, 2026). BYODKIM is fully manual: you generate keys, publish DNS records, and swap selectors yourself. This guide walks through both, when rotation actually matters, and how to do it without breaking signed mail in flight.
Why Rotate DKIM Keys At All
DKIM rotation limits the blast radius if a private key is exposed and reduces the window in which an attacker with an older copy of your key can forge signed mail from your domain. The M3AAWG "DKIM Key Rotation Best Common Practices" guidance recommends rotating at least once per year and immediately on compromise; it also recommends 2048-bit RSA as the modern floor for new keys (M3AAWG). For SES senders, this matters most for BYODKIM, where the key lives on disk somewhere you control.
The threat model is narrow but real. A compromised private key lets an attacker DKIM-sign mail that claims to come from your domain, bypassing the strongest part of DMARC alignment. Because most receivers cache DKIM public keys briefly, the attack window from a leaked key is bounded by how recently it was last used to sign legitimate mail. Annual rotation keeps that window short by default.
Easy DKIM vs BYODKIM Rotation
The rotation story splits cleanly along the Easy DKIM / BYODKIM line. Easy DKIM gives AWS custody of the private key, publishes three CNAME records that point to AWS-controlled DNS, and uses a 2048-bit key by default (AWS, 2026). BYODKIM puts the entire key lifecycle on you - generation, DNS publishing, selector naming, and rotation cadence. The trade-off is portability versus convenience.
| Aspect | Easy DKIM | BYODKIM |
|---|---|---|
| Recommended for most senders | ✓ Yes | Only if you need key portability |
| Who holds the private key | AWS (managed) | You |
| Default key size | 2048-bit RSA | 1024-2048 bit RSA (your choice) |
| DNS record type | 3 CNAMEs (pointer to AWS) | 1 TXT (your public key) |
| Auto-rotation by AWS | ✗ No | ✗ No |
| Manual rotation possible | Yes (flip key length, throttled to 1×/24h) | Yes (generate new key, swap selector) |
| Use same key across regions | Via Deterministic Easy DKIM (DEED) | Yes - same private key works everywhere |
| Effort to rotate | Low (console toggle) | Moderate (key gen + DNS + API call) |
The practical takeaway: pick Easy DKIM unless you have a concrete reason to control the private key yourself (multi-provider signing, compliance policies that require holding the key, or wanting to align DKIM selectors across SES and another sending platform). Most senders never need to leave Easy DKIM.
Rotating Easy DKIM Keys
Easy DKIM does not rotate on its own. SES generates a 2048-bit RSA key when you enable Easy DKIM for a domain identity and reuses that key until you intervene. The only built-in rotation mechanism is the "DKIM signing key length" toggle in the SES console - flipping between RSA2048BIT and RSA1024BIT issues a new key pair under new CNAMEs (AWS, 2026). AWS throttles this to one change per 24 hours to protect in-flight mail.
For most senders, Easy DKIM rotation is a non-event. AWS holds the key inside its own infrastructure, so the practical exposure surface is whatever you trust AWS to control - the same trust boundary as your KMS-encrypted secrets and root account credentials. If a security policy requires periodic rotation, the simplest path is:
- Open the SES console, choose your region, go to Verified identities, and pick the domain.
- Under Authentication > DomainKeys Identified Mail (DKIM), choose Edit.
- Switch the DKIM signing key length from 2048 to 1024, save, wait 24 hours, then flip back to 2048.
- Update the three CNAME records at your DNS provider each time (the token values change).
- Verify the status returns to Successful in the DKIM configuration field.
Each flip publishes three new CNAMEs and effectively rotates the underlying key pair. There is no "rotate now, keep the same length" button - the length toggle is the rotation handle.
If your domain also uses a custom MAIL FROM domain, the MX and SPF records there are unaffected by DKIM rotation. The two systems are independent.
Rotating BYODKIM Keys (Step by Step)
BYODKIM rotation is fully manual and follows the standard DKIM dual-publish pattern. You bring up a new selector with a fresh key pair, switch SES to sign with it, then retire the old selector after a grace period long enough that no in-flight mail still references it. Done in this order, recipients can verify mail signed under either selector at any moment during the cutover.
The full sequence, assuming you are rotating a domain example.com currently using selector s2025 and want to move to s2026:
Step 1 - Generate a new 2048-bit RSA key pair.
openssl genrsa -f4 -out s2026.private.key 2048
openssl rsa -in s2026.private.key -outform PEM -pubout -out s2026.public.key
The private key must be PKCS #1 or PKCS #8 format and base64 (PEM) encoded; SES accepts 1024-2048 bit RSA but 2048 is the only sane choice in 2026 (AWS, 2026).
Step 2 - Publish the new public key as a DNS TXT record.
Strip the -----BEGIN PUBLIC KEY----- / -----END PUBLIC KEY----- lines and newlines from s2026.public.key, then publish at:
s2026._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhki..."
Wait until the record is resolvable from public DNS (dig +short TXT s2026._domainkey.example.com should return the value). DNS propagation can take up to 72 hours, though most providers update within minutes (AWS, 2026).
Step 3 - Switch SES to sign with the new selector.
aws sesv2 put-email-identity-dkim-signing-attributes \
--email-identity example.com \
--signing-attributes-origin EXTERNAL \
--signing-attributes "DomainSigningPrivateKey=$(cat s2026.private.key | sed '1d;$d' | tr -d '\n'),DomainSigningSelector=s2026"
After this call, every new SES send signs under s2026. Verify with aws sesv2 get-email-identity --email-identity example.com - you want SigningAttributesOrigin: EXTERNAL, SigningEnabled: true, Status: SUCCESS.
Step 4 - Send a test message and inspect headers.
Send a probe to a mailbox you control. In the raw headers, the DKIM-Signature: line should show s=s2026; d=example.com. Verify with dkim-verifier, opendkim-testmsg, or a Gmail message header view (look for "signed-by: example.com" on a delivered message).
Step 5 - Wait 7-14 days, then remove the old selector.
Leave the old s2025._domainkey.example.com TXT record published for at least 7 days, ideally 14. This grace period covers receivers that briefly cached the old public key and any mail still queued in third-party forwarders. After the window, delete the old TXT record. Done.
This is the same dual-publish pattern recommended by M3AAWG for DKIM key rotation generally, adapted to SES's API surface. For the underlying authentication concepts and how DKIM interacts with SPF and DMARC during a rotation, see our SPF, DKIM, and DMARC explained primer.
Common Mistakes
Three failure modes account for most DKIM rotation incidents. None are unique to SES, but SES's API surface makes them easy to walk into.
Deleting the old DNS record too early. The most common mistake. You swap SES to the new selector, see a clean test message, delete the old TXT record the same day - and a chunk of yesterday's queued mail fails DKIM at the receiver because the old selector no longer resolves. Wait the full 7-14 day grace period; the cost of leaving an unused TXT record published is zero.
Picking a 1024-bit key in 2026. BYODKIM still accepts 1024-bit RSA, but every modern mailbox provider treats 1024 as weak (AWS notes 2048 is the default in Easy DKIM for security reasons). Use 1024 only if your DNS provider literally cannot host a longer TXT record - and in that case, consider a different DNS provider rather than weakening DKIM.
Forgetting that DKIM is per-region in SES. SES Easy DKIM and BYODKIM are per-region: rotating in us-east-1 does not rotate in eu-west-1. If you send from multiple regions on the same domain, either rotate in every region (BYODKIM lets you reuse the same key everywhere - the simpler path) or use Deterministic Easy DKIM (DEED) so a parent identity's key replicates to other regions automatically (AWS, 2026).
Recommended Rotation Cadence
The chart below shows the rotation cadence we recommend for typical SES senders. The fast cadence at the start of a key's life is not standard practice - it's a compromise-response window. After the first verification, annual rotation is the M3AAWG floor; many senders never rotate Easy DKIM at all and that is also defensible if AWS retains key custody.
In short: rotate same-day on compromise, schedule annual rotation for BYODKIM, and accept that Easy DKIM users routinely run the same 2048-bit key for years without consequence. Quarterly rotation is a control that costs more than it saves outside regulated industries.
How Mailblast Handles DKIM for Your SES
Mailblast operates on your own Amazon SES account (BYO-SES), so DKIM is whatever you've configured in SES. Mailblast does not insert its own signing keys, override your selector, or maintain a parallel key store. If you're on Easy DKIM, AWS still holds the key and rotation is a console toggle inside your AWS account. If you're on BYODKIM, you own the rotation procedure described above and Mailblast simply hands the message to SES, which signs with whichever key SES has been configured to use.
This separation is intentional. It means the same DKIM signature appears on your mail whether you sent it via the AWS SDK, via the SES SMTP endpoint, via Mailblast, or via any other tool layered on top of your SES account. For senders new to SES, our Amazon SES setup guide walks through Easy DKIM verification end to end before you connect Mailblast.
FAQ
Does Amazon SES automatically rotate DKIM keys?
No. AWS does not silently rotate your Easy DKIM key on a schedule. Easy DKIM generates a 2048-bit key once at setup and keeps using it until you change the key length or re-create the identity. BYODKIM is fully manual: you generate, publish, and swap keys yourself. M3AAWG recommends at least annual rotation regardless of mode.
What DKIM key size does Amazon SES use by default?
Easy DKIM uses a 2048-bit RSA key by default; you can downgrade to 1024 if a DNS provider does not support longer TXT records. BYODKIM accepts keys between 1024 and 2048 bits. 2048-bit is the modern recommendation - 1024-bit DKIM is considered weak and should only be used as a fallback (AWS, 2026).
How often should I rotate DKIM keys?
M3AAWG recommends rotating DKIM keys at least once per year, and immediately if a private key is exposed. In practice, Easy DKIM users rarely manually rotate (the same 2048-bit key is reused for years), while BYODKIM users should schedule rotation annually and treat key compromise as a same-day incident.
How do I rotate a BYODKIM key in SES without breaking signatures?
Use a dual-publish swap. Generate a new RSA 2048 key pair under a new selector name and publish the public key as a TXT record. Call PutEmailIdentityDkimSigningAttributes to switch SES to the new selector. Wait a 7-14 day grace period so in-flight mail can still verify against the old DNS record, then delete the old TXT record.
Can I rotate Easy DKIM keys manually?
Effectively yes, by flipping the signing key length between 1024 and 2048 bits in the SES console. SES throttles changes (you cannot switch more than once per 24 hours), and each flip publishes new CNAMEs. For most senders this is unnecessary - the original 2048-bit key is fine until AWS or your security policy says otherwise.
Disclosure: Mailblast is a hosted management layer for your own Amazon SES account. DKIM keys, selectors, and rotation policy live entirely inside your AWS account; Mailblast neither holds your private key nor signs your mail on its own.