Can we have 2 simultaneous DKIM entries? | Community
Skip to main content
Grégoire_Miche2
Grégoire_Miche2
New Participant
March 23, 2016
Solved

Can we have 2 simultaneous DKIM entries?

  • March 23, 2016
  • 4 replies
  • 5159 views

As we are transition from an old Marketing automation solution to Marketo, we would need to temporarily have 2 DKIM entries in our DNS. Does anyone know if this possible ? Anything to know about this ?

Thx in advance,

-Greg

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Roxann_McGlump1

Hello Gregoire,

You should be able to have two DKIM keys as long as they are not on the same domain (m1._domainkey.olddomain.com vs. m1._domainkey.newdomain.com.) or on the same selector (m1._domainkey.yourdomain.com vs m2._domainkey.yourdomain.com.)

If the domainkey and selector are the same for both systems, you could contact Marketo support and request that the old domain key be copied to your Marketo instance, and essentially the one key would sign emails for both your old and new marketing automation systems.

4 replies

Grégoire_Miche2
Grégoire_Miche2Author
New Participant
March 23, 2016

Thanks to each of you, that is very clear.

I also understand that it would be more complex to have a DKIM for a Marketo prod and a Marketo sandbox, as both will want to use the same selector, but for my migration purpose, it should be OK.

-Greg

Justin_Cooperm2
Justin_Cooperm2
New Participant
March 23, 2016

Yeah, just create an entry in Marketo with the same domain. We don't let you modify the selector at this point, and it will be m1. Your other DKIM key with your other platform probably uses a different selector so you should be good. It is totally valid to have different DKIM entries using different selectors.

SanfordWhiteman
SanfordWhiteman
New Participant
March 23, 2016

Like Roxanne said, multiple DNS TXT DKIM keys with two different selectors are totally fine (in fact necessary), while multiple DNSTXT DKIM keys for the same selector are not allowed. 

What's interesting (in my opinion) is that the strict prohibition only applies to DNS-based public keys (keys stored in DNS).  Obviously this makes up 99.999% of the current landscape of DKIM.  But in the (currently) unlikely event that you are feeding keys into a DKIM validating-app without retrieving them from DNS (via any other protocol, presumably, and/or from a database), the validator is allowed to cycle through the keys, checking for a match, instead of erroring out.  Because of this disparity in the spec, relatively lax validators may cycle through your DNS-based keys instead of instantly returning an error. Anyway, don't have more than one key for the same selector.

Roxann_McGlump1
Roxann_McGlump1Accepted solution
New Participant
March 23, 2016

Hello Gregoire,

You should be able to have two DKIM keys as long as they are not on the same domain (m1._domainkey.olddomain.com vs. m1._domainkey.newdomain.com.) or on the same selector (m1._domainkey.yourdomain.com vs m2._domainkey.yourdomain.com.)

If the domainkey and selector are the same for both systems, you could contact Marketo support and request that the old domain key be copied to your Marketo instance, and essentially the one key would sign emails for both your old and new marketing automation systems.

Terms & ConditionsAccessibility statement

Loading footer...