DKIM ROTATION CHECKLIST
- Generate new private key securely
- Publish new selector
- Validate DNS visibility
- Enable signing with new selector
- Confirm pass at multiple providers
- Keep old key during transition
- Retire old selector after observation window