Skip to content
MapleGatherMapleGather Help

DKIM rotation overdue

The deliverability dashboard shows an amber alert, “DKIM rotation incomplete — verify DNS record” — “The new DKIM key’s record has not verified in 7 days. Publish it, then verify.” You started a DKIM key rotation more than 7 days ago, and the new key’s DNS record hasn’t verified yet.

What’s happening

Section titled “What’s happening”

When you rotate your DKIM key, MapleGather’s email provider generates a new key, and the page shows it on a New DKIM key card with its own Host and Value. Your current key keeps signing your email until the new key’s record verifies — so your email is still signed and still sending.

The alert means the new record still hasn’t verified after 7 days. Common causes:

  • The new record hasn’t been added at your DNS provider yet.
  • It was added at the wrong name — the new key has a new Host, different from your current DKIM record’s.
  • The current DKIM record was edited instead of a new record being added.
  • A typo or extra character in the Value.

How to fix it

Section titled “How to fix it”

1. Copy the new record from MapleGather

Section titled “1. Copy the new record from MapleGather”
  1. Go to Email deliverability (at /admin/email/deliverability).
  2. Find the New DKIM key card. Copy its Host and Value with the copy buttons. The record Type is TXT.

2. Add the record at your DNS provider

Section titled “2. Add the record at your DNS provider”
  1. Log in to your DNS provider.
  2. Add a new TXT record with the Host and Value you copied. Don’t change or delete your current DKIM record — it’s still signing your mail.
  3. Save the record.

3. Verify the new record

Section titled “3. Verify the new record”
  1. Return to Email deliverability (at /admin/email/deliverability) and select Verify all records. While you keep the page open and the rotation is pending, it also checks again automatically (up to 20 times per visit, paused while the tab is hidden); nothing checks while the page is closed. [amended pre-merge 2026-10-20, c21 E panel-r2]
  2. When the new key verifies, the New DKIM key card disappears, the DKIM record card shows the new key as Verified, and the alert goes away.

DNS propagation can take up to 48 hours.

If that didn’t work

Section titled “If that didn’t work”
  • Confirm the record at your DNS provider is a TXT record at exactly the Host on the New DKIM key card, and that its Value matches character for character.
  • Use an external DNS lookup tool to check what DNS is serving at that Host.
  • You can’t start another rotation while this one is waiting — Rotate DKIM key stays hidden, and a new rotation would be refused with “A rotation is already waiting for its new DNS record.”
  • If an external lookup shows the record correct but it still doesn’t verify, the remaining cause is that MapleGather’s email provider, which checks the new key, hasn’t seen the record yet — DNS answers can take up to 48 hours to reach every resolver. Select Verify all records again later. Until the new key verifies, your current key keeps signing, so your mail stays signed and keeps sending.
Section titled “Related”