DKIM rotation overdue
The DKIM record card on the deliverability dashboard shows an amber or red badge, or “Rotation overdue” text, indicating that your DKIM key is past its 7-day transition window.
What’s happening
Section titled “What’s happening”When you rotate your DKIM key, MapleGather generates a new key and gives you 7 days to update your DNS record. During those 7 days, the old key continues to sign outgoing mail so any in-transit emails are still valid. On day 8, the system expects only the new key in DNS.
If your DNS record isn’t updated to the new key within the 7-day window, the DKIM card transitions from Expiring to Rotation overdue. Outgoing emails may still be sending, but they’re no longer signed with a validated key — which can affect deliverability.
How to fix it
Section titled “How to fix it”1. Get the new DKIM key from MapleGather
Section titled “1. Get the new DKIM key from MapleGather”- Go to Email > Deliverability in the sidebar.
- On the DKIM record card, the new key value is shown. Copy the Value from the card.
If the card doesn’t show a new key value (for example, if the rotation is stuck), proceed to step 7 to re-rotate.
2. Update your DNS record
Section titled “2. Update your DNS record”- Log in to your DNS provider and locate your current DKIM record.
- Replace the existing value with the new value you copied from the card. The Host (record name) stays the same — only the Value changes.
- Save the change.
3. Verify the updated record
Section titled “3. Verify the updated record”- Return to Email > Deliverability and select Verify on the DKIM card. If DNS has picked up the change, the card shows a green Verified badge.
DNS propagation can take up to 48 hours. If verification doesn’t pass immediately, wait 15 minutes and try again.
4. If no new key is shown — re-rotate
Section titled “4. If no new key is shown — re-rotate”- If the DKIM card doesn’t show a pending new key value, you may need to start a new rotation.
- Select Rotate DKIM key on the DKIM card.
- Complete the multi-factor authentication prompt when requested — this is required before MapleGather generates a new key.
- Copy the new Value and update your DNS record (steps 3–6 above).
If that didn’t work
Section titled “If that didn’t work”- If DNS verification doesn’t pass after 48 hours, confirm the exact value in your DNS settings matches what’s on the card — a single mismatched character will cause failure.
- Try verifying from a different network or device, as local DNS caching can show a stale value.
- Contact MapleGather support if the card continues to show Rotation overdue after updating your DNS record and waiting 48 hours.