Treat selectors as rotation slots

A selector identifies the DNS location of a public key. Create a new selector such as s2026b rather than overwriting the public key at s2026a while messages signed with the old private key may still be evaluated. Use the signer or provider’s supported key-generation process and keep private key material out of tickets, source control, and DNS.

Review current algorithm guidance. RFC 8301 requires signers using RSA to use keys of at least 1024 bits and recommends at least 2048 bits; operational DNS limits and receiver/provider support still need testing. Do not reuse a private key across unrelated environments for convenience.

Stage the new public key

Publish the new selector’s TXT record or provider-directed CNAME. Query authoritative and recursive DNS, parse the record, and verify that it corresponds to the intended private key using a controlled signing test. Record TTL, creation time, custodian, and rollback.

Do not remove or alter the old selector. DNS propagation language should stay precise: caches can retain prior answers up to their observed TTLs, and not every resolver refreshes at the same moment.

Switch signing and observe

Configure one controlled stream or bounded cohort to sign with the new selector. Send fresh representative messages and inspect trusted receiver Authentication-Results. Confirm the expected d=, new s=, supported algorithm, and successful verification. Test multiple message forms if gateways or templates can transform content.

Expand the switch while monitoring failures. Keep the old private key protected and available only as needed for rollback; continuing to publish its public key does not cause senders to use it.

Retire deliberately

Choose an overlap that covers normal queue delays, retries, and the organization’s operational evidence needs. After all signers use the new selector and no legitimate new signatures reference the old one, stop and destroy the old private key according to key-management policy. Later remove or revoke its DNS record through a documented change.

Keep evidence of the transition: old and new selectors, public-key fingerprints, systems changed, receiver tests, dates, and approvers. The rotation is complete when new mail verifies, old signing has stopped, and obsolete private material is retired—not merely when a new TXT record exists.