Question DKIM: Key rollover / Policy?

[B_P]

Dear all,

given that Plesk support DKIM key signing, I was wondering how I can actually generate new keys for a domain which already uses keys. In contrast to DNSSEC, where the procedure for rolling over keys is implemented and documented (Using DNSSEC (Linux)), I did not find anything with regard to how this works for DKIM.
Re-creating keys for DKIM could be necessary for instance when keys are compromised or when you want to change the key length. Thus, my questions related to the DKIM Keys are:
- How can I set specific parameters such as the key length and algorithm to be used when (automatically) generating the key?
- For regular roll-overs it is advised to keep the old key for a while until the new key is properly propagated and all mails using the old key are delivered. Thus, the new key should use a different selector and the old key & selector should only be deleted some days later. I assume this is not yet implemented? When disabling and enabling DKIM a new key is created but using the same selector.

One more question: DKIM, SPF, and DMARC Protection explains that the _ domainkey.<example.com> contains the DKIM Policy. Isn't this an outdated DNS record which was only used for the old version of (Yahoo) Domain Keys?

 

[B_P]

@IgorG (sorry for always tagging you, but as you reply in most cases, I hope this is ok) any idea?

 

[mizar]

Hello,

At this moment, Plesk doesn't very friendly for updating DKIM keys: almost all settings are hardcoded in Plesk code, so you need manually recreate the private key, and update DNS records. More detailed instructions can be found in  How to get the DKIM public key from Plesk if DNS is not installed?

For regular roll-overs it is advised to keep the old key for a while until the new key is properly propagated and all mails using the old key are delivered. Thus, the new key should use a different selector and the old key & selector should only be deleted some days later. I assume this is not yet implemented? When disabling and enabling DKIM a new key is created but using the same selector.

Yes, selector is hardcoded to 'default' as well.

One more question: DKIM, SPF, and DMARC Protection explains that the _ domainkey.<example.com> contains the DKIM Policy. Isn't this an outdated DNS record which was only used for the old version of (Yahoo) Domain Keys?

No, it doesn't exacly true - although this policy can be evaluated by sender, but nowadays it mostly replaced by DMARC policy.

 

[B_P]

No, it doesn't exacly true - although this policy can be evaluated by sender, but nowadays it mostly replaced by DMARC policy.

Where in the most recent RFC do you see this resource record? Also, if you have a look at major sites regarding DKIM, this resource record is never mentioned.

 

[Gerinho]

I was wondering how I can actually generate new keys for a domain which already uses keys

I'm wondering this too!