Managed DKIM and automatic key rotation

Short summary

Managed DKIM lets Lettermint rotate your signing keys automatically. You do not have to change your DNS records for each future key rotation. The upgrade does not interrupt sending. Your existing DKIM setup stays active during the migration.

What changes

Before the upgrade, your domain uses one DKIM TXT record that contains a public key. You must change this DNS record when the key changes.

After the upgrade, your domain permanently uses these two CNAME records:

• lm1._domainkey
• lm2._domainkey

Lettermint hosts the public keys behind these CNAME records and rotates the keys for you. Both CNAME records must stay in DNS after the upgrade.

Your SPF, DMARC, return-path, and other DNS records do not change. Your API credentials, SMTP credentials, and application configuration also do not change.

Why should I upgrade?

Signing keys need regular rotation. With a TXT-based setup, each key change needs a new DNS update. This creates more manual work and can delay a key rotation.

Managed DKIM gives you these benefits:

• Lettermint can rotate your DKIM keys automatically.
• You do not have to update DNS for each future rotation.
• Lettermint can prepare and verify a new key before it becomes active.
• Your existing DKIM setup stays active while you upgrade.
• The dashboard monitors the two managed DKIM records.

Regular key rotation reduces the time that an old key can be used if it becomes compromised. It also removes a repeated DNS task from your maintenance work.

Why there are two records

Each DKIM record uses a selector. A selector tells a receiving mail server which public key it must use to check the signature on an email.

Lettermint uses two selectors so that one key can stay active while the other key is prepared and verified. Lettermint can then switch to the new key safely. You do not have to change DNS during the switch.

Before starting

Make sure that these statements are correct:

• You have permission to update the domain in Lettermint.
• You or a colleague can update the domain at its DNS provider.
• Existing email can continue to be sent during the upgrade.
• If another person manages DNS, you can use Share instructions on the DNS page to send the required records to that person.
• You have not deleted or replaced the current DKIM TXT record.

Open Domains (opens in a new window) in the Lettermint dashboard and select the domain that you want to upgrade.

Step-by-step upgrade

1. Open the DNS page for your domain.
2. Select Start upgrade.
3. Add the two generated CNAME records at your DNS provider. Copy each name, type, and target exactly as the dashboard shows them.
4. Wait for Lettermint to verify both records.
5. When the dashboard shows Ready to activate managed DKIM, select Activate managed DKIM. Confirm the warning in the activation window.
6. Leave the old TXT record and both new CNAME records in place during the migration period.
7. Wait until the dashboard shows Automatic key rotation enabled, or until the completion email confirms that the upgrade is complete.
8. Only then, remove the old DKIM TXT record that Lettermint identifies. Keep both new CNAME records permanently.

When both CNAME records are verified, the dashboard shows this state:

What happens during activation

Lettermint temporarily supports your existing key and managed DKIM during the transition. This keeps DKIM authentication available while the new setup becomes active.

• The dashboard shows the earliest automatic completion date and time.
• Completion happens automatically if both new CNAME records stay verified.
• Email sending should continue normally during the process.
• After activation starts, you cannot cancel the migration period.

Use the dates and durations that the dashboard shows for your domain. These values can change. The displayed time is the earliest possible completion time. It does not confirm completion. Do not remove the old TXT record until the dashboard or completion email confirms completion.

Cancelling an upgrade

You can cancel the upgrade before you activate managed DKIM. Your existing DKIM setup continues to work.

After you cancel, you can remove the temporary lm1 and lm2 CNAME records. If you start the upgrade again later, Lettermint can give you new values. Always copy the records from the current upgrade. Do not use values from an earlier cancelled attempt.

You cannot cancel the upgrade after activation starts.

Common DNS provider problems

If the two CNAME records do not verify, check these common causes:

• Some DNS providers add the domain name automatically. Do not create a name such as lm1._domainkey.example.com.example.com.
• Copy each CNAME target exactly. Do not remove a part of the target.
• Create CNAME records. Do not create TXT records when the dashboard requests CNAME records.
• Remove a conflicting record that already uses the same lm1 or lm2 hostname. A hostname cannot usually have a CNAME and another record type at the same time.
• In Cloudflare, set both CNAME records to DNS only. Do not proxy them.
• DNS changes can take time to propagate.
• Do not remove a record only because verification is temporarily pending.

Lettermint checks the records again automatically. You can also select Verify all on the DNS page. For general domain setup information, see the domain documentation.

After completion

The completed dashboard state looks like this:

After completion:

• Remove only the old DKIM TXT record identified by Lettermint.
• Do not remove DKIM records that belong to another email service.
• Keep lm1._domainkey and lm2._domainkey permanently.
• Keep your existing SPF, DMARC, return-path, and other records unless Lettermint gives you a separate instruction.
• Future DKIM key rotations happen automatically.
• The dashboard shows Automatic key rotation enabled.

Troubleshooting and FAQ

Will upgrading interrupt email delivery?

No. Your existing DKIM setup stays active during the upgrade. Lettermint also supports the managed setup during the transition. If you keep the old TXT record and both new CNAME records in place, sending should continue normally.

Can I keep sending while DNS propagates?

Yes. Continue to send email with your existing setup. Do not remove or replace the old DKIM TXT record while the new CNAME records propagate.

Why are my CNAME records not verifying?

Check the record type, name, and target. Make sure that your DNS provider did not add the domain name twice. Remove conflicting records at the same hostname. If you use Cloudflare, make sure that the records are DNS only. DNS propagation can also delay verification.

Can I use the same records shown in an earlier cancelled attempt?

Do not reuse an old set of values. Start the upgrade again and copy the records that the dashboard currently shows. A new attempt can have different CNAME targets.

When may I remove the old TXT record?

Remove it only after the dashboard shows Automatic key rotation enabled, or after the Lettermint completion email confirms that the upgrade is complete. The email identifies the exact old record. Do not remove it when the dashboard shows Ready to activate, when you select Activate managed DKIM, or when the migration is still in progress.

Why must both CNAMEs remain?

Lettermint keeps one selector active while it prepares and verifies the other selector. Both records are necessary for safe automatic key rotation. Keep both records permanently.

Does this change SPF or DMARC?

No. Managed DKIM changes only the DKIM setup. Your SPF, DMARC, return-path, API credentials, SMTP credentials, and application configuration stay the same.

Can someone else perform the DNS changes?

Yes. Select Share instructions on the domain's DNS page. Send the instructions to the person who manages the DNS provider. You can continue the upgrade after Lettermint verifies both records.

What should I do if I removed the old record too early?

Restore the old TXT record immediately if you can. Keep both new CNAME records in place. Then check the DNS page and wait for all required records to verify. Contact Lettermint support (opens in a new window) from the dashboard if you cannot restore the record or if email authentication fails.

What happens if one managed CNAME is removed later?

Email that uses the missing selector can fail DKIM authentication. Automatic key rotation also cannot work safely without both records. Restore the missing CNAME with the exact value from the dashboard and verify it as soon as possible.