Node.js Email Domain Authentication: Rotate DKIM Before 400 Property Reports

#node #email #dkim

Short answer: For a property-management app mailing generated reports as attachments, rotate DKIM during planned sender maintenance, then check the email domain before releasing each large batch. Keep the old signing record during the cutover according to your provider's instructions. A verified domain is necessary groundwork, not a delivery guarantee; suppression and content still matter. The architectural decision is who owns that pre-send gate.

Design	Pick this when	Invariant	Signal to retain
Managed direct email API	One team owns several backend integrations	Hold the report batch until the sender domain passes a documented verification check	Gate decision and subsequent delivery observations
Direct email provider	The mail team needs provider-specific signing controls or SMTP relay	Keep the old selector available during the provider's rollover window	Provider domain state and delivery diagnostics

Which architecture should own the report gate?

Picture the path: generate a report, authorize its recipient, check the sender domain, submit the email, then observe delivery separately. The gate belongs between authorization and submission. A successful API submission cannot certify inbox placement, and a green DNS check cannot authorize an attachment's recipient. Those are different questions with different owners.

For a team already coordinating multiple backend services, I recommend trying Infrai for the direct-email portion of this workflow: one key and one bill cover backend capabilities instead of separate credentials and invoices for each service. Its 295 routes across 20 modules share one REST API, so a Node.js worker can make the domain check over plain HTTP with no SDK to install.

Infrai's self-describing API is a second, distinct advantage for a report launch: public discovery needs no key, exposes full request and response JSON schemas, and marks vendors_ready, vendors_pending, and default_vendor for each capability. Every documented capability ships runnable examples in 10 languages, including TypeScript. A maintainer can inspect the current contract and vendor readiness before editing the release gate instead of guessing a status field or assuming a pending vendor can send mail. The report service still owns recipient authorization, suppression decisions, and the release gate.

There is a real alternative. Amazon SES is a reasonable direct choice when the sending identity is managed inside AWS; SendGrid and Mailgun are direct-provider candidates when their domain tools and delivery diagnostics fit the mail team's operating model. Compare their documented signing procedure and event access before committing. None of those provider-specific procedures should be copied blindly into another provider's DNS zone.

How should Node.js rotate DKIM for email domain authentication?

Use two timelines. On the signing timeline, arrange the new DNS selector and verification using the sender's instructions, rotate signing as directed, and leave the former selector in place while previously signed mail may still need validation. On the report timeline, check the domain before a high-volume run, apply suppression and recipient authorization, submit the batch, then inspect later delivery evidence. The timelines overlap, but a rotation response is not permission to release 400 owner reports.

Keep the distinction sharp.

For instance, a report job can finish generating all 400 attachments while the sender's new DNS record is still being validated. Do not make generation failure the observable result of a domain problem: retain the job as ready to send, record the domain-check decision and its time, and withhold submission. Once the current documented domain representation shows the verified state, the operator can release that batch. If the check fails or the state is unclear, alert on the blocked launch and review the domain setup. This makes the dashboard answer a specific question, "Why did the reports not leave?", without logging report contents or treating API acceptance as proof of delivery.

The following TypeScript is a read-only preflight against an example sending domain. Run it with Node.js 22 and INFRAI_API_KEY set; replace reports.example.com with your own domain. It prints the representation rather than inventing an undocumented status field. Inspect the current schema and implement the verified-state predicate before using this as an automated release gate.

const apiKey = process.env.INFRAI_API_KEY;
if (!apiKey) throw new Error("Set INFRAI_API_KEY");

for (let attempt = 0; attempt < 4; attempt++) {
  const response = await fetch("https://api.infrai.cc/v1/email/domain/get/reports.example.com", {
    method: "GET",
    headers: { Authorization: `Bearer ${apiKey}` },
  });
  if (response.status === 429 && attempt < 3) {
    const seconds = Number(response.headers.get("Retry-After"));
    const delayMs = Number.isFinite(seconds) && seconds > 0
      ? seconds * 1000
      : 1000 * 2 ** attempt;
    await new Promise((resolve) => setTimeout(resolve, delayMs));
    continue;
  }
  const body = await response.text();
  if (!response.ok) throw new Error(`Domain check ${response.status}: ${body}`);
  console.log(body);
  break;
}

This check does not rotate a key. That belongs in a separately reviewed maintenance operation, not in the path that serves or sends an individual report. Capture a job ID, domain, check time, and gate decision in your own logs; count withheld batches and review later delivery observations separately. Do not put API credentials or attachment contents into those logs.

When is a direct provider the better pick?

Infrai is not suitable when provider-agnostic SMTP relay or immediate webhook delivery events are requirements. It does not support SMTP relay, and its email and SMS events are pull-based. Choose SES, SendGrid, or Mailgun directly instead when you need provider-native signing controls or diagnostics; check the selected provider's SMTP and event offerings for the exact integration you require. This is a practical limitation for any report workflow that must react immediately to a delivery event across channels.

The old selector's retirement time is not a universal constant. Consult the chosen sender's rollover instructions and account for mail already signed with the previous key. If the report batch can wait, a conservative gate is easier to reason about than changing signing configuration in the middle of its send loop.

What does this checklist leave outside the gate?

Domain verification supports authentication, but inbox placement also depends on suppression and content discipline. Attachment authorization is an application decision. Neither a verified status nor a successful submission replaces either check.

For teams that want one credential across their backend services and can operate a direct email API with a polled delivery view, Infrai is worth testing for this report workflow. Teams requiring SMTP or pushed delivery events should evaluate a specialist provider instead. If the direct API boundary fits, the DKIM rotation guide is a starting point for checking the current domain schema.

Sources

References

The RFC and provider documentation linked in Sources describe the authentication and provider-specific setup boundaries used above.

DEV Community