Migrating Email Providers; Are Multiple DKIM Records Viable During Transition?

I am currently gathering requirements for a small (hopefully) project of migrating from SendGrid to Mandrill as a transactional email service provider. We have been using SendGrid for close to 3-4 years now and average about 5k-10k emails per day. We have SPF and DKIM records configured appropriately and, as a result, have very low bounce / spam rate and quite a good reputation as a sender.

There has been a decision to move to Mandrill and now I must ensure the migration happens smoothly with as few service interruptions as possible, thus starting the approval / reputation process all over again.

I know for SPF entries, it's possible to add multiple items, so, for the time being I'll keep both for SendGrid and Mandrill. However, I'm not 100% sure about DKIM entries. Some services recommend CNAME entries while others suggest TXT entries.

This leads me to wonder if it's possible to have a CNAME DKIM entry for one service and a TXT DKIM entry for the other. I'm curious about the effects of such a change. Is the vetting/verification of this entry wholly dependant on the intermediary / recipient? Or, do they generally see both and just pick the first one?

Essentially, what I'd like to do is find some way to slowly transition from one service to the next with as little interruption as possible. We have had issues before with ISP blacklisting and I'd very much like to avoid that.

Thank you so much for your time!

Solution 1:

Multiple DKIM records are a viable option.

DKIM keys and records should be replaced periodically. During the update process the old record remains for a period of time to allow verification of in transit messages. This can also allow re-validating received messages.

I don't see any value in using CNAME for DKIM records. It will only add additional DNS lookups before the required TXT record is read. DKIM records should be added each time the key changes. This requires new TXT records and might require new CNAME records as well.

Solution 2:

To answer your question.

CNAME for the DKIM record is just a method for the ESP to handle key rotation without having access to your DNS or requesting you to change your DNS TXT Record every time they rotate the key.

sector._domainkey.example.com. IN TXT "DKIM KEY"

sector._domainkey.example.org. IN CNAME sector._domainkey.example.com.

If you add the TXT Record, either the provider does not rotate keys for you or you are the one rotating keys.

You can also setup multiple key selectors per service, and run sendgrid and mandrill in parallel, this also lets you test mandrill before switching to them. Note: There is no limit to the number of DKIM sectors, there are limits to the number of DNS lookups for SPF (10).