---
title: "Rotate your DKIM keys automatically with managed DKIM"
description: "Managed DKIM rotates your DKIM keys on a schedule, without interrupting your sending. No key stays in use longer than it should."
url: "https://lettermint.co/changelog/managed-dkim-key-rotation"
published: "2026-08-14"
last_updated: "2026-08-14"
---

# Rotate your DKIM keys automatically with managed DKIM

> Managed DKIM rotates your DKIM keys on a schedule, without interrupting your sending. No key stays in use longer than it should.

You add a domain, you set up a few DNS records and then
you would rather not think about it again. Terms like
[DKIM](https://lettermint.co/knowledge-base/definitions/what-is-dkim)
come with sending
[transactional email](https://lettermint.co/features/transactional-emails),
but you should not need to be an expert to get it
right.

A DKIM key is something you set up once and then leave
alone. For years, usually.

With managed DKIM we rotate that key for you on a
schedule, without you having to arrange anything and
without interrupting your sending. Here is what it is
and why you want it.

## What managed DKIM does

Sending email through Lettermint takes a few DNS
records, one of which is DKIM. That record holds a
public value that lets recipients verify a message
really came from your domain. With *managed DKIM* we
look after that record for you.

The key we sign your email with does not get weaker
over time, but it should still have a limited lifespan.
The shorter a key is in use, the smaller the risk. That
replacement is now on us.

Email security guidance recommends replacing a DKIM key
regularly. And if you work to a standard like
[ISO 27001](https://lettermint.co/roadmap/iso-27001),
you need to be able to show that keys have a defined
lifespan.

![Lettermint Managed DKIM](https://lettermint.co/content/changelog/lettermint-managed-dkim.webp)

## Setting it up

New domains come with managed DKIM from the start, so
there is nothing to do there. Domains you added earlier
you can switch over yourself, whenever it suits you.

Open your
[domains](https://app.lettermint.co/domains)
and go to the DNS page of the domain you want to
switch. If the upgrade is ready for you, you will find
**Start upgrade** there. You get two CNAME records to
add alongside your existing DNS records.

We then check whether the records are in place. Once
they are, you can activate managed DKIM. Not every
recipient picks up your new records right away, so your
old and new setup both keep working and your sending
carries on.

> **Warning:** Leave your old DKIM record in place until the switch is
> complete. We will tell you in your dashboard and by
> email. Only then can you remove it, the two new records
> stay.

## How DKIM key rotation works

Every six months we replace the key we sign your email
with. You will not notice a thing, because the two
records in your DNS take turns. We put the new key on
whichever record is not in use, check that everything
is right and only then switch over.

You do not have to wait for the next round either. If
you want to move to a new DKIM key sooner, you can
start the rotation yourself from your dashboard.

## Available now

Managed DKIM is ready for all your domains. Our
[knowledge base](https://lettermint.co/knowledge-base/deliverability/managed-dkim-and-key-rotation)
covers exactly how the switch runs, what to do if a
record will not verify and how to cancel it if you
would rather wait.