Rotating the key without a gap
The signing key has been the same for four years and someone has finally scheduled a rotation. The plan is to generate a new key, publish it, and swap the signer over.
Mail is not synchronous. Messages sit in queues, get retried for days, and are verified whenever the receiver gets round to them. A verifier checking a message signed an hour ago looks up whatever is in DNS now — not what was there when the message left.
Outside every boundary: Outbound signer (picks a selector), The old key record (still published), Mail still in flight (retried for days), Receiver verifies (later, not now), an empty slot for the safe before anything else, an empty slot for the wait for DNS first, an empty slot for the wait for the queues Connections: safe before anything else calls wait for DNS first (step 1) wait for DNS first calls wait for the queues (step 2) wait for the queues controls The old key record — last, not first (step 3) Outbound signer controls wait for DNS first — switches here Mail still in flight publishes to Receiver verifies — verified days later The old key record controls Receiver verifies — still being fetched