DKIM key too short (1024-bit) and how to rotate it

What it means

DKIM signs each email with a private key kept on the sending server. The matching public key is published in your DNS. The longer the key, the harder it is to forge your signature. Keys of 1024 bits were standard for years, but 2048 bits is now the recommended size. Keys of 512 or 768 bits are considered broken and many receivers ignore them.

"Rotating" a key means replacing it with a new one, which is good practice from time to time and urgent if the private key may have leaked.

Why it matters

• A weak key can, in theory, be cracked, letting someone sign emails as your domain.
• Some receivers and security audits flag 1024-bit keys.
• A key that has been used for many years, or that was on a server you no longer control, should be replaced.

How to check

Send a test email to your address on the home page (/). The DKIM section shows the selector used (the s= value) and whether the signature passes. You can also scan your domain at /domain-scanner. A 2048-bit public key in DNS is much longer than a 1024-bit one, around 400 characters.

How to fix it

The safe method is to use a new selector, so the old and new keys exist side by side during the switch.

With an email provider

• Google Workspace: in the Admin console's DKIM settings, generate a new record and choose 2048 bits. Publish it, wait for DNS, then start authentication again with the new key.
• Microsoft 365: new domains use 2048-bit keys. Microsoft can rotate keys for you from the DKIM settings in the Defender portal, using its two selectors.
• Newsletter tools: most manage key size themselves. Check their documentation if your test shows a short key.

With your own server (OpenDKIM)

1. Create a key with a new selector, for example named after the date:

   opendkim-genkey -b 2048 -d yourdomain.com -s 2025a

2. Publish the public key from 2025a.txt as a TXT record on 2025a._domainkey.yourdomain.com. Some DNS panels need long values split into several quoted parts of 255 characters or less; most panels do this for you.
3. Wait until the new record is visible everywhere, at least a few hours.
4. Switch signing to the new key and selector in your OpenDKIM configuration, then restart OpenDKIM.
5. Keep the old record for about a week, so emails signed just before the switch can still be checked.
6. Remove the old record from DNS, or replace it with an empty key (v=DKIM1; p=) to show it is revoked.

Good habits

• Rotate keys every six to twelve months.
• Keep private keys readable only by the signing service.
• Rotate immediately if a server holding the key was compromised.

Check that it is fixed

Send a new test from the home page. The DKIM section should show the new selector and a passing signature. Run /domain-scanner to confirm the new record is published, and check after a week that the old one has been removed.