NAME

       dkim-rotate - rotate and revoke and invalidate DKIM keys

SYNOPSIS

       dkim-rotate [options] --new [instance ...]
       dkim-rotate [options] --major [instance..]
       dkim-rotate [options] --minor [instance ...]
       dkim-rotate [options] --status [instance ...]
       dkim-rotate [options] --reinstall [instance ...]

DESCRIPTION

       dkim-rotate  is a tool for managing DKIM (email antispam) keys in a manner that avoids unnecessarily mak‐
       ing emails nonrepudiable.

       For each instance, dkim-rotate maintains several keys concurrently, using “selectors” in a circular rota‐
       tion.

       See dkim-rotate(7) for the Principles of Operation, and details of how to configure your  MTA,  DNS,  and
       WWW server.

       If no instance is provided, dkim-rotate will operate on all instances matching [a-z][-_0-9a-z]* for which
       the configuration file /etc/dkim-rotate/instance.zone exists.

       See dkim-rotate(5) for details about the instance configuration file.

       If  an  instance is provided and contains a slash, it will be treated as a pathname; otherwise it will be
       taken as a reference to the configuration file in /etc.

       dkim-rotate should normally be run out of cron.  It will produce progress information on stdout.  It will
       produce stderr output if and only if something is wrong.

MODE OPTIONS

       --major
              Make progress.  Create new keys, advance to using different keys, and reveal old keys,  as  neces‐
              sary.

       --minor
              Make progress, but do not advance to using a new key.  If you wish your keys to be rotated at par‐
              ticular  times  of the day or week, you should run with --major at those times, and --minor other‐
              wise.

              For example, the suggested/default configuration runs with --major at 0400 local time.  The effect
              is that emails sent on a particular day all cease to be repudiable at the same time.

       --new  Make progress, and, additionally, allow the creation of a new instance.  Without --new, it  is  an
              error if there is a config file, but no recorded state.

       --reinstall
              Do  not  make  any progress, but force recreation, reinstallation and reload of MTA and DNS output
              files.

       --status
              Produce a status report of all the relevant keys.  Do not make any changes.

OTHER OPTIONS

       --etc-dir=etc-dir
              Look for instance configuration files in etc-dir rather than /etc/dkim-rotate.

       --var-dir=var-dir
              Look for instance state directories in var-dir rather than /var/lib/dkim-rotate.

AUTHOR

       Copyright 2022 Ian Jackson and contributors to dkim-rotate.
       There is NO WARRANTY.
       SPDX-License-Identifier: GPL-3.0-or-later

SEE ALSO

       dkim-rotate(5)
              Configuration file

       dkim-rotate(7)
              Principles of Operation

       RFC6376
              DKIM Signatures

                                                                                                  dkim-rotate(1)