Two sets of DKIM records for a domain: Representing a second set of DKIM records on a domain is not necessarily redundant – it all depends on your email system. Different email service providers, rotation of the keys in the name of security, and delegation of the subdomains would all require multiple records as each do not intermix in operating independently. Nevertheless, replicating records with the same selector has the potential to lead to authentication errors. Failing to deliver their mails, and leaving old keys in DNS as well as poor management of multiple DKIM records, all of which jeopardize the security. Adequate measures of managing such setups – employing different selectors, rotating keys. And deleting unwanted records, can keep several DKIM records. Enhancing email security without introducing undue complexities to the setup.
What is DKIM and Why it Matters?
DKIM (DomainKeys Identified Mail) supports an email authentication scheme in which messages cannot be altered during transit and actually originate within the domain that they are purporting.
When you send mail, the mail delaying server adds a digital signature to the header. The digital signature is created using a secret key and is also verified, using an appropriate public key. By the receiving mail server with reference to the corresponding key sitting in the DNS record of your domain.
The advantages of the DKIM are:
- Email integrity: This ensures that the email has not been corrupted in any way during transit.
- Protection of brand: Prevent spammers to spoof your domain.
- Better deliverability: Email with correct DKIM signings have less chances of being redirected to the spam.
- DMARC and its SPF and DKIM configuration: A secure email structure is provided using a combination of SPF and DKIM, as well as DMARC.
Can I have Duplicate DKIM Records on homogeneous Domains?
Technically a domain can have more than one DKIM record, but it is not a solution. DKIM records will use selectors which permit multiple keys to be associated with one domain.
Example:
rejected.example.com 2.nickname.example.com
The selectors have different pointers to public keys. This enables you to:
- Change keys to be more secure.
- Use different providers (e.g., one key for Google Workspace, another for Mailchimp).
- Migrate to a new mailing provider easily.
Therefore, two DKIM keys are acceptable but the two active DKIM records with the same selector are not a good combination and this leads to failed authentication.
DKIM: Two Sets of Records: Excessive or Required?
Let us analyze the situations when multiple DKIM records may be present and compare them whether it is a waste or not.
The Reputable Reasons to possess many DKIM Records:
- Several Email Service Providers (ESP):
In case you have multiple emails on the same Google Workspace and newsletters through Mailchimp, they will both have to have their own DKIM record. Two DKIM records is not especially a lot (there) however, it is required here. - Security Key Rotation:
It is a recommended practice to rotate DKIM keys on a regular basis in order to minimize the likelihood of compromise. In between you can have two live DKIM records. So the new one can be transitioned when the old one is to be deprecated. - Subdomain Delegation:
The email duties are sometimes assigned to subdomains in multi-purposed organizations so each of the subdomains warrants distinct DKIM records.
When DKIM entries are redundant
- Duplicates:
Should you forget and submit two DKIM records with the same selector, you get mail servers not knowing which key to use and fail authentication. One can prevent this and it is counterproductive. - Still Keys in DNS
Removal of old DKIM keys long after they have been retired exposes your attack surface to additional risk without any added benefit - Uncontrolled Multi-Practitioner Mess:
Switching between providers frequently can leave DKIM records all over your DNS and this may end up confusing the receiving servers and negatively affecting your deliverability.
Why Having Two DKIM Records Could Cause Issues
There is no maliciousness pre-programmed in the use of multiple DKIM records. But the mismanagement of such can lead to severe effects. That is why:
- Email authentication failure: DKIM records that overlap one another or conflict with each other can cause a genuine email to fail authentication.
- Increased Deliverability failure: With the decreased DKIM verification, the risk of being sent to spam increases.
- Security Risks: Unredeployed, unused, or stale DKIM records present security risks depending on how properly a key is decommissioned.
- Management Overhead: The more DKIM records you maintain, the harder it is to manage and audit them effectively.
Best Practices to Handle DKIM Records
Advise recommendation: if you plan or already use two sets of DKIM records, do the following:
- Choose Different Selectors per Provider:
Apportionment to two providers should never be done using the same selector. e.g. Gmail= google._domainkey and Mailchimp = mailchimp._domainkey. - Change the Keys Often
Consider implementing a key-rotation policy in which old keys are changed with new ones after regular periods of time to reduce the risk of compromise. - Clean up Old Records
Ensure to cancel DKIM records of a decommissioned provider in the DNS. - Test and Monitor:
Use DKIMCore or MxToolbox or Google Admin Toolbox to ensure that your DKIM setup is working properly. - Pair DKIM with SPF and DMARC:
DKIM alone isn’t enough. A well-configured SPF record and a DMARC policy provide a multi-layered approach to email security.
Conclusion: Is Two Sets of DKIM Records for a Domain Overkill?
Two sets of DKIM records for a domain: is that redundant? That all depends on context. If you change keys, or change providers, or rotate keys, more records are justified, and often essential. But when you are doing extra unnecessary copying of records, or leaving historic and abandoned keys in your DNS. Then it is indeed overkill and even destructive.
The trick is to be judicious in management: selectors should be used sparingly. Old keys should be rotated and unused records discarded. This will reinforce your email authentication, brand protection and ensure deliverability by adding any additional complexity.
