3 ms·
Key rotation doesn't make it impossible to validate, unless the old private key gets disclosed. I don't think many providers do that.
by remram 4y ago
Key rotation doesn't make it impossible to validate, unless the old private key gets disclosed. I don't think many providers do that.
- georgyo 4y agoYou need access to the public, which is DNS, which won't be accessible after it rotated. The provider has no reason to keep either the public or private key either.
- remram 4y agoI assumed historical DKIM public keys were easy to find on the web, but that doesn't seem to be the case. This is weird because they are very little data and don't rotate every year, so archiving every key from Google, Amazon, etc would be easy. Of course you would need multiple trusted sources for the key to have confidence that the mail is legit.