Provider documentation checked on 8 November 2026. Account-generated values, entitlements and current support remain deployment prerequisites.
Choose the correct operation
DuoCircle's outbound relay supports per-domain DKIM signing. First activation and rotation have different timing risks, so decide which you are performing before touching DNS. Record the sending domain, applications using the relay, current selector if any, DNS owner and a safe pause mechanism for new submissions.
The DKIM setup guide places controls in the service's Sender Domains & DKIM page in the client area. Each domain must be listed and enabled. It warns that first activation begins signing immediately, before recipients necessarily can resolve the new public key. A green signing toggle is therefore not a completed deployment.
Plan first activation around publication
References: RFC 6376 §3.6.2.
Arrange a change window that limits exposure while the generated TXT record is published and checked. View the domain's DKIM settings and use the generated owner and value at the authoritative DNS provider. Do not reuse a selector or key from another tenant, and never publish private signing material.
If the first-activation workflow cannot stage the public key before signing starts, pause affected submissions until DNS and a controlled message have been checked. Do not assume a switch to YES means public resolvers already have the record. Save the prior route and toggle state so the team can restore the last approved configuration if necessary.
Rotate with overlap rather than replacement
References: RFC 6376 §3.6.2.
For an existing signer, DuoCircle documents generating a new selector and public key without immediately switching active signing. Publish the new TXT record, verify it, then complete rotation in the domain's DKIM tools. Leave the old selector intact while queued messages signed with that key may still be delivered.
Its 2048-bit key update explains selecting 2048-bit strength through a new rotation, using generated record-format options as needed, and checking with Retry DKIM check before moving signing. Do not extrapolate the announcement's historic default to every current account; inspect the actual selected key strength.
A long TXT value may require multiple character strings inside one TXT record. That is different from publishing several competing key records at the same selector. Follow the DNS provider's input rules and verify that the logical public-key value is intact. An attractive line break in a ticket is not necessarily harmless when pasted into a DNS editor.
Prove the active key changed
References: RFC 9989 §4.4, RFC 6376 §6.
Original acceptance worksheet: record the old selector, proposed selector, public DNS answer, provider verification result, activation time and first controlled message using the new selector. Retain the receiver's DKIM result and d= domain alongside the visible From. A passing signature with an unrelated signing domain does not by itself satisfy DMARC alignment.
Illustrative scenario: the new key is correctly published, but the operator never completes rotation. Existing messages continue to verify under the old key. Deleting the old TXT record at this point converts a harmless incomplete rollover into an authentication failure. The delivered s= selector reveals which key is actually in use.
Define recovery and retirement separately
If publication fails before rotation, leave the active signer and its DNS untouched while correcting the proposed record. If a failure occurs after switching, pause the affected route and consult the supported recovery controls rather than assuming the old private key can be selected again. Keeping a public key does not guarantee that the service retains the corresponding signing key.
Retire the old record only after new signing is observed and queued-message dependencies are resolved. Recheck after application additions or sender-domain changes. Documentation was reviewed on 8 November 2026. No DuoCircle account, live key rotation, DNS update or message delivery was executed here.