DKIM key rotation mechanism — not hardcoded

A hardcoded DKIM private key is a secret embedded in source code — readable by anyone with repository access and impossible to rotate without a code deployment and DNS change happening in exact coordination. CWE-321 (hard-coded cryptographic key) and CWE-338 (weak PRNG for key material) both apply. When a DKIM key is compromised, the only remediation is to publish a new key under a new selector and retire the old one; with a static selector and no secrets manager, that operation requires a full deployment cycle, during which your signing infrastructure is either broken or still using the exposed key.

Load the DKIM private key from a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager) keyed by a selector that is controlled via environment variable, so rotating to a new key means publishing a new DNS record and updating one env var — no code deployment required.

import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager'

const client = new SecretsManagerClient({ region: process.env.AWS_REGION })

export async function getDkimKey(): Promise<{ privateKey: string; selector: string }> {
  const selector = process.env.DKIM_SELECTOR ?? 'k1'
  const { SecretString } = await client.send(
    new GetSecretValueCommand({ SecretId: `email/dkim/${selector}` })
  )
  const { privateKey } = JSON.parse(SecretString!)
  return { privateKey, selector }
}

For nodemailer, pass the returned { privateKey, selector } directly into the dkim transport option. Never commit key material — store the secret in the manager and the selector name in .env.local (not checked in).