3 ms·
Why not just rotate them frequently? Like weekly? Or daily even? ProtonMail makes you setup 3 CNAMEs for DKIM just so they can frequently rotate without your i
by brightball 6y ago
Why not just rotate them frequently? Like weekly? Or daily even?
ProtonMail makes you setup 3 CNAMEs for DKIM just so they can frequently rotate without your intervention or disruption. Sendgrid uses 2 for the same thing.
- tomc1985 6y agoWhat's stopping someone from recording each public key as it is entered into service and providing a DKIM authentication service with it? There are already such things for domain data.
- mspecter 6y agoHi! Check out our Usenix 2021 paper on exactly this topic. The key insight is to release private keys over time: http://www.mit.edu/~specter/blog/2020/dkim/ http://www.mit.edu/~specter/blog/2020/dkim/