Guide · DKIM Architecture

DKIM for multi-region teams

Coordinate selectors, rotations, and alignment policies across hybrid email stacks without losing deliverability visibility.

Selector blueprint

Use this blueprint when onboarding new regions or providers. Add it to your runbooks so every team member follows a consistent approach.

Selector naming

Use region and environment hints (`sfo-prod`, `ams-prod`, `sfo-staging`) to speed up troubleshooting.
Avoid numbers-only selectors—Gmail treats them as lower trust.
Keep names <= 31 characters for compatibility with older MTAs.

Key rotation cadence

Rotate 2048-bit keys every 90 days for primary senders, 180 days for low-volume systems.
Overlap selectors during rotation (old selector remains active until new one has delivered for 24 hours).
Log rotations in SendCheck notes so compliance teams can verify alignment history.

Alignment policies

Match the DKIM `d=` domain to the From domain for strict alignment when possible.
If subdomains are needed, document exceptions and update your DMARC policy accordingly.
Use SendCheck’s nightly drift checks to ensure selectors stay published and aligned.

Provider matrix

Quick reference across the platforms most teams deploy. Each row links to the official guide.

Google Workspace

Docs

Supports up to 5 active selectors per domain. Use Google Admin API to rotate programmatically.

Microsoft 365

Docs

Each custom domain gets two CNAME selectors (`selector1`, `selector2`). Rotate by switching endpoints.

SendGrid

Docs

Assign a dedicated IP pool per region and map selectors via the branded link interface.

Postmark

Docs

Generate per-stream DKIM keys; align bounce domains to maintain DMARC compliance.

Case study · Notion

Notion publicly documented its shift to multi-region DKIM with SendGrid and Google Workspace. They rotated selectors gradually and published a short postmortem detailing lessons learned.

Read the post →

Alignment watchlist

Add your transactional subdomains to SendCheck's watchlist. If the selector drifts or alignment breaks, we alert owners via Slack so they can rotate keys before customers notice.

Automate selector rotations with SendCheck APIs

Trigger DKIM rotations via CI/CD when new keys are generated and automatically verify alignment before deployment.

View API examples