Monitor email deliverability and rotate DKIM

This guide shows you how to read the deliverability dashboard, act on a high bounce rate, and rotate your DKIM signing key when needed.

Who can do this: Admins who can view deliverability reports (for monitoring) and admins who can manage deliverability settings (for rotating DKIM). DKIM rotation additionally requires a recent sign-in, so you may be asked to sign in again first.

Before you start

DKIM rotation requires your DNS provider login — you’ll add a new DKIM record after MapleGather’s email provider generates the new key.
Rotate DKIM key appears only while your DKIM record is verified and no other rotation is waiting for its record.
Your current key keeps signing your email until the new key’s record verifies, so sending isn’t interrupted. If the new record isn’t verified within 7 days, the dashboard reminds you.

Steps

Review the deliverability dashboard

Go to Email deliverability (at /admin/email/deliverability).
Check the status badge on each DNS record card — SPF, DKIM, and DMARC. A green Verified badge on all three means your sending configuration is healthy.
Review the metrics row:
- Bounce rate — the percentage of dispatched emails that bounced over the last 7 days.
- Delivery rate — the percentage of dispatched emails that reached mail servers.
If the bounce rate exceeds 2%, a Review bounced recipients notice appears. Select it to open the per-recipient log filtered to bounced addresses.

Act on a high bounce rate

Work through the bounced-recipient list. For each bounced address: a. Open the member’s record. b. Correct the email address if there’s a typo. c. If the address is permanently invalid, contact the member to get their current email.
After correcting addresses, the bounce rate should decrease over the next 7-day rolling window.

Rotate your DKIM key

Rotate DKIM as part of a regular security review, for a compliance audit, or if you suspect the key was compromised.

On Email deliverability (at /admin/email/deliverability), select Rotate DKIM key.
A confirmation dialog opens: your email provider generates a new signing key, and your current key keeps signing until the new one verifies. Select Rotate key.
If you’re asked to confirm it’s you, select Confirm identity. We’ll send you to sign in again — you’ll be asked for your password even though you’re already signed in — and bring you straight back. There’s no code to type. This extra step is required before a new key is generated.
A New DKIM key card appears, with the date the rotation started. Copy its Host and Value — the Host is a new name, different from your current DKIM record’s.
Log in to your DNS provider and add a new TXT record with that Host and Value. Keep your current DKIM record — it’s still signing your mail.
Save the record at your DNS provider.
Return to Email deliverability (at /admin/email/deliverability) and select Verify all records. While you keep the page open and the new record isn’t verified, it also checks again automatically (up to 20 times per visit, paused while the tab is hidden). [amended pre-merge 2026-10-20, c21 E panel-r2]

DNS propagation can take a few minutes to 48 hours.

Verify

You’ll know the rotation is complete when the New DKIM key card disappears and the DKIM record card shows Verified with the new key’s Host and Value. Until then, the New DKIM key card stays on the page and your current key keeps signing.

If something goes wrong

“Rotating the DKIM key needs a more recent sign-in.” — For your security, rotating your DKIM key needs a more recent sign-in than the one you have. Select Confirm your identity, sign in again when we send you there, and you’ll come straight back. There’s nothing to type here.
You signed in again and it still isn’t recent enough — the prompt says so, and its Confirm identity button is gone; only Close is left. That usually means the sign-in completed from the session you already had, without actually asking you for your password. Reload the page — that is what brings the button back — then start the rotation again and go straight through without pausing. Make a note of anything you have not saved on this page first, such as a test-send address you typed: reloading clears the whole page, not just the rotation prompt. There’s nothing to enable and nobody to ask — signing in again is what satisfies this, and you can do it yourself right now. If it keeps happening, your sign-in is being completed from the session you already have, so it never counts as recent. Sign out of MapleGather completely, sign back in with your password, then start the rotation again.
You cancelled at the sign-in page, or came back without signing in — the dialogs close and you’ll see “Rotation cancelled — the DKIM key is unchanged”. Nothing was rotated and your current key keeps working. Rotate DKIM key is still there when you’re ready.
“A rotation is already waiting for its new DNS record.” — a previous rotation’s record isn’t verified yet. Publish the record on the New DKIM key card and verify it before starting another.
“Set up a From address before rotating the key.” — no domain is registered for your organization yet: no From address is saved, or its domain’s ownership hasn’t been proven. Reload the page and finish setting up your From address first. [amended 2026-10-21, c21 track BQ]
“Verify DKIM before rotating the key.” — your domain’s first DKIM key isn’t verified yet, so there’s nothing to rotate. Finish setting up your DNS records first.
“The email provider is unavailable. Try again in a few minutes.” — nothing was rotated; try again shortly.
“DKIM rotation incomplete — verify DNS record” — the new record hasn’t verified within 7 days. Your current key is still signing. See DKIM rotation overdue.
The new key won’t verify after 48 hours — confirm you added the new record as a TXT record at the new Host, with the Value copied exactly.