Hacker News Reader

Why not just rotate them frequently? Like weekly? Or daily even?

ProtonMail makes you setup 3 CNAMEs for DKIM just so they can frequently rotate without your intervention or disruption. Sendgrid uses 2 for the same thing.

View on HN

What's stopping someone from recording each public key as it is entered into service and providing a DKIM authentication service with it? There are already such things for domain data.

Hi! Check out our Usenix 2021 paper on exactly this topic. The key insight is to release private keys over time:

http://www.mit.edu/~specter/blog/2020/dkim/

Reply on news.ycombinator.com