Discover active selectors

Collect representative messages from every sending stream and record each DKIM d= and s= pair. Add provider configuration, existing zone data, and change records. Do not assume selector names follow one pattern or that a zone export includes provider-managed aliases outside the main interface.

Classify selectors as active, retained for overlap, retired, or unknown. Investigate unknowns before excluding them. Preserve CNAME targets exactly and distinguish them from TXT keys.

Compare old and new authoritative data

Before delegation changes, query each active selector directly at an old authoritative server and at a new authoritative server:

dig @old-ns.example TXT selector._domainkey.example.com
dig @new-ns.example TXT selector._domainkey.example.com

Use the record type actually configured. Compare logical TXT content rather than presentation-only quote splitting. For CNAME, follow the target and confirm it remains reachable. Record TTLs, DNSSEC considerations if used, and the complete NS/delegation plan.

Stage a controlled cutover

Populate and validate the new zone before changing delegation. Lowering TTLs must occur early enough for previous cached TTLs to expire. Define rollback using the exact prior nameserver set and ensure both zones can remain consistent during the transition.

Query delegation and authoritative answers from multiple useful resolvers after cutover. Treat timeout, SERVFAIL, and no-data responses distinctly. A web checker’s single success cannot establish global consistency.

Verify message signatures

Send fresh messages from every legitimate stream. Confirm that they use expected selectors and that trusted receivers report DKIM pass for the intended signing domains. A DNS answer alone cannot prove body/header verification. Monitor temporary failures and provider alerts through the change window.

Keep the old authoritative service available according to the rollback and propagation plan; do not delete the old zone immediately. Close the migration only when delegation is stable, every active selector is present, messages verify, and unknown selectors have a documented disposition. Store sanitized evidence and public-key fingerprints rather than private keys or customer messages.