Issue Description
When I enabled DKIMv2, the existing v1 keys were rotated out by DKIM automatic management. At some point the task automatically removed the recods from the zone, as expected, leaving me with the expected four records (2x Ed and 2x RSA).
The old v1 DKIM key set is currently marked DKIM key has been removed from DNS and is pending deletion with a next transition date of Sept 7.
When running task DNS Management for Domain today, the task repopulated the two deleted records back into the DNS zone.
Expected Behavior
DNS Management tasks should recognize that the records have already been marked as deleted and should not repopulate them.
Actual Behavior
Records marked deleted are repopulated.
Reproduction Steps
- Perform DKIM rotation.
- Wait for old key records to expire and be removed.
- Perform DNS management task on domain before the next rotation date arrives.
Relevant Log Output
Deleted records repopulated first
2026-08-21T20:58:11Z INFO DNS record created (dns.record-created) hostname = "v1-ed25519-20260529._domainkey.example.ca.", details = "example.ca", type = "TXT", value = ["v=DKIM1; k=ed25519; h=sha256; p=lTfcZ3zFxjrxnsT06ZMfX0Kd54ENkmvA72yieEHdbm0="]
2026-08-21T20:58:11Z INFO DNS record created (dns.record-created) hostname = "v1-rsa-20260529._domainkey.example.ca.", details = "example.ca", type = "TXT", value = ["v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu2QjsGzb0YJKKnW3gRkybD+Ea0VY4fPfV9dtYuXUN7n2lNc1xlunQB8KhD8AkPW+gq8bGIl5MQOcT6SdhHTCIfLBzRgMIH0SjFZrJJL2iLgKLJ99sIWvaQapPxHZInlQVD2wrxzNrk8WxZBnZ8RH0uIccpBrbIX4MpTNhpXHxw6w/AZUbapfl2RCGIv4wksEaiJJZyRCXv4+s/+TY7U6q8D4zO2rGrDngWsiH00tcgRPFrWZ3mMdxE/kML3MIod9KLlPB3so8E9jMrPAA90L3gsNNFiKYw0nqlRVBO7wJZugemO077gcy3r/0cwX2CjX4nLKvFwwoBDPi0jMtdf/PwIDAQAB"]
Proper records repopulated after
2026-08-21T20:58:09Z INFO DNS record created (dns.record-created) hostname = "v2-ed25519-20260802._domainkey.example.ca.", details = "example.ca", type = "TXT", value = ["v=DKIM1; k=ed25519; h=sha256; p=3m7r093JS4J1yaoP0I0tf93nocaF4MKWuOVdaLC+73Y="]
2026-08-21T20:58:09Z INFO DNS record created (dns.record-created) hostname = "v1-rsa-20260801._domainkey.example.ca.", details = "example.ca", type = "TXT", value = ["v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuP7HzC9smvkVEc7+U+lDy+ns9wZeG2NLINUJWK10jI7Rcs4WiPu4uLNbojMQMcJN/HjAGY0D0HtaCtCm08JDuUNCALFMD+u7InJuPuCdXNWVEGgRhpMVT42BAeJXZftebc9cEvCUyLq8tWSQVzOfJ64ofkryKU1qTxfBJMVVIL5C3lXw6nXlk6xAiZJrNydh0OUiMUWZW8SHq8bzrCNSdc4oi5wVbF9CCRWiU56+3XasopkgRW0hbT6yRDsghEqG2hP5h57R0sV21CM96XG7i9PLa2BnhyfsdAohPdBidJNfZ/JPQqGS5qbd/7svWY3lUywhmYkkNl7QvfLfnFvtlQIDAQAB"]
2026-08-21T20:58:13Z INFO DNS record created (dns.record-created) hostname = "v1-ed25519-20260801._domainkey.example.ca.", details = "example.ca", type = "TXT", value = ["v=DKIM1; k=ed25519; h=sha256; p=VXn3t1vPMrq0Jy9E2Wo2Q4tgebMkrQ7wOi0DASxfFeg="]
2026-08-21T20:58:13Z INFO DNS record created (dns.record-created) hostname = "v2-rsa-20260802._domainkey.example.ca.", details = "example.ca", type = "TXT", value = ["v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyKn2rCg2Nfjt7pFe1CM1AVitIJcqElsBOP81SZLv4I6Si8100zV90HAFeE2CkEXS1S8ty2RxVS+pR+/oMjWiI9SUsQtUIRZcF43I2zbldDehAy7RUbCkAWx3wJUDHQpGd4qHuFLyCmuHKg03EfW+kXBbs/bVlL1NFODAHl7dux8XVGfQtD9Ti1VvkzzkWDAtpnHNx/RWdvbnO38IRJl8XeA7Kmw8Zgv8sgaQM4+9qeCI55St9hEXgP+wkdnjj/a85vmRo11lUxmE8UDBOOxewfk9sYz/bnYXtAad3TleDkviybeJ6KiN26asy3hRdU8PwCx/64OFqSz5xeNMBZx+WwIDAQAB"]
Stalwart Version
v0.16.x
Installation Method
Binary (Linux)
Database Backend
PostgreSQL
Blob Storage
S3-compatible
Search Engine
Internal
Directory Backend
Internal
Additional Context
v0.16.18
I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
on
I have searched this support forum (open and closed topics) and confirm this is not a duplicate.
on
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on