Skip to content
MapleGatherMapleGather Help

Monitor email deliverability and rotate DKIM

This guide shows you how to read the deliverability dashboard, act on a high bounce rate, and rotate your DKIM signing key when needed.

Who can do this: Admins who can view deliverability reports (for monitoring) and admins who can manage deliverability settings (for rotating DKIM). DKIM rotation additionally requires completing a multi-factor authentication challenge.

Before you start

Section titled “Before you start”
  • DKIM rotation requires your DNS provider login — you’ll need to update the DKIM record after generating the new key in MapleGather.
  • After rotation, the old DKIM key stays valid for 7 days. Day 8 onward, only the new key signs outgoing mail.

Steps

Section titled “Steps”

Review the deliverability dashboard

Section titled “Review the deliverability dashboard”
  1. Go to Email > Deliverability in the sidebar.
  2. Check the status badge on each DNS record card — SPF, DKIM, and DMARC. A green Verified badge on all three means your sending configuration is healthy.
  3. Review the metrics row:
    • Bounce rate — the percentage of dispatched emails that bounced over the last 7 days.
    • Delivery rate — the percentage of dispatched emails that reached mail servers.
  4. If the bounce rate exceeds 2%, a Review bounced recipients notice appears. Select it to open the per-recipient log filtered to bounced addresses.

Act on a high bounce rate

Section titled “Act on a high bounce rate”
  1. Work through the bounced-recipient list. For each bounced address: a. Open the member’s record. b. Correct the email address if there’s a typo. c. If the address is permanently invalid, contact the member to get their current email.
  2. After correcting addresses, the bounce rate should decrease over the next 7-day rolling window.

Rotate your DKIM key

Section titled “Rotate your DKIM key”

Rotate DKIM when the card shows an Expiring or Rotation overdue badge, or as part of a regular security review.

  1. On Email > Deliverability, find the DKIM record card and select Rotate DKIM key.
  2. A confirmation dialog opens. Read the summary and select Continue.
  3. Complete the multi-factor authentication prompt. This extra step is required before MapleGather generates a new key.
  4. After authentication, copy the new Host and Value shown in the DKIM record card.
  5. Log in to your DNS provider and locate your current DKIM record.
  6. Update the record’s Value to the new value from step 10. The Host stays the same.
  7. Save the change at your DNS provider.
  8. Return to Email > Deliverability and select Verify on the DKIM card.

DNS propagation can take a few minutes to 48 hours. If verification doesn’t pass immediately, wait 15 minutes and try again.

Verify

Section titled “Verify”

After DKIM rotation, the DKIM card shows Verified with the new key’s rotation date. For the next 7 days, the dashboard shows both the old key (transitioning) and the new key (active).

If something goes wrong

Section titled “If something goes wrong”
  • Authentication prompt fails — generate a fresh code from your authenticator app and enter it within 30 seconds.
  • DKIM card shows “Rotation overdue” — your old key has passed the 7-day overlap window. Rotate as soon as possible and update your DNS record.
  • Verify won’t pass after 48 hours — confirm you copied the new DNS Value exactly. Try verifying from a different network, as DNS caching can cause the check to see a stale value.
Section titled “Related”