It appears that Richard Clayton <[email protected]> said: >So today I think this was probably a mistake and unless anyone loves it >(and can tell us how to combine the two results) then I will insist on >just one signature per algorithm (which mean unique selectors because >keys say which algorithm they are for)
I rotate my DKIM1 keys every month by publishing a new selector with the new key on the 27th of the previous month, then switch to signing with that selector on the 1st of the month, then delete the old selector on the 10th of the month and poison it by publishing the private key. Works fine, been doing it for years. This does require that I have sufficient control over my DNS to add and delete TXT records automatically, but I have limited sympathy for people who want to do complicated key management and don't have a DNS API. R's, John _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
