[ Sending-service guides ]
Authenticate email sent through DuoCircle: configuration and verification
Enable or rotate DuoCircle outbound DKIM with a clear distinction between first activation and a staged key rollover.
By the EmailAuth research team · 3 min read
[ Key points ]
- First activation and rotation have different signing timing.
- Publish and verify the proposed key before switching rotation.
- Keep old public keys while old signed messages remain in transit.
[ Takeaway ]
Keep old public keys while old signed messages remain in transit.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Track the selector in use
DNS publication alone does not switch the signer.
Next steps
- Publish the proposed key.
- Verify before rotation.
- Inspect s= on received mail.
CISO / SecOps
Keep key handling disciplined
Public verification records and private signing keys have different roles.
Next steps
- Keep private keys out of DNS.
- Review key strength deliberately.
- Record the supported recovery path.
Founder / Non-technical
Schedule the signing transition
First activation has a different exposure window from rotation.
Next steps
- Approve a change window.
- Name the application pause owner.
- Require evidence before retirement.
[ FAQs ]
Frequently asked questions
Where are DuoCircle signing controls?
In the service’s Sender Domains & DKIM configuration page in the client area.
Does first activation wait for DNS?
The setup guide warns that signing begins immediately. Plan publication and a submission pause accordingly.
Is rotation the same as first activation?
No. The documented rotation creates a proposed key before active signing moves to it.
How do I choose a 2048-bit key?
Use the key-strength option in a new rotation and verify the generated record before moving signing.
2025-12-13: Outbound SMTP DKIM signing with 2048-bit keys : DuoCircle
Can I delete the old selector as soon as DNS validates?
No. Confirm the active signing switch and account for queued messages using the old key.
Should I split a long key into several TXT records?
No. DNS character-string chunks belong to one logical TXT record; follow the host’s input format.
2025-12-13: Outbound SMTP DKIM signing with 2048-bit keys : DuoCircle
What proves that rotation actually happened?
A controlled delivered message with the new s= selector and successful receiver verification.
Does retaining the old public key guarantee rollback?
No. It preserves verification for old messages but does not prove the service retains a usable old private key.
[ Sources ]
Sources
- DomainKeys Identified Mail (DKIM) : DuoCircle
Sections Configuring DKIM for a sending domain · Rotating your DKIM Key · Restarting the key rotation process
- 2025-12-13: Outbound SMTP DKIM signing with 2048-bit keys : DuoCircle
Sections §13 December 2025 update: 2048-bit rotation and Retry DKIM check
- RFC 7208
Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits
- RFC 6376
Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions
- RFC 9989
Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail
[ Glossary ]
Glossary
- SPF
- DNS authorization for the SMTP envelope-sender domain, subject to protocol limits.
- DKIM
- A signature verified using a public key at a selector under the signing domain.
- DMARC alignment
- The required relationship between the visible From domain and a passing SPF or DKIM authentication domain.
- Authoritative DNS
- The delegated DNS service responsible for the published zone answers.
- Selector
- The DKIM identifier used with the signing domain to locate the public key.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption