Long DKIM key in DNS: TXT records split into several strings

What it means

A DKIM record holds a public key, a long block of letters and numbers. A 2048-bit key, the recommended size today, is about 400 characters long.

DNS has a rule: a single text string in a TXT record can hold at most 255 characters. A longer value must be stored as several strings, one after the other, inside the same record. Receivers join them back together without adding anything in between.

google._domainkey  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...first part" "...second part...IDAQAB"

Why it matters

If the key is cut, has an extra space, or is split into two separate records, the receiver gets a wrong key. Every DKIM signature then fails, and DMARC can fail with it. The email looks fine to you but scores worse everywhere.

How to check

• Send a test email from the Delivmail home page. The report shows DKIM "fail" or a key error even though your provider says DKIM is on.
• Use the Domain scanner at /domain-scanner to look at your DNS records.
• Look at the raw record:

  dig TXT google._domainkey.yourdomain.com

  Replace google with your selector. You should see one record, possibly with several quoted parts.

How to fix it

1. Copy the key again from your provider's admin page (for example the Google Admin console for Google Workspace). Copy the whole value, from v=DKIM1 to the end.
2. Try pasting it as one value. Many DNS providers (Cloudflare, OVH and others) accept a long value and split it for you.
3. If the panel refuses it, split it yourself into parts of less than 255 characters, each in double quotes, separated by a space:

   "v=DKIM1; k=rsa; p=MIIBIjANBg...(about 200 characters)" "...rest of the key"

   The space between the quoted parts is ignored. Spaces inside the quotes are not.
4. Keep it in one record. Two separate TXT records with half a key each do not work.
5. Save and wait a few minutes, then test again.

Common mistakes

• A line break or space copied in the middle of the key.
• The key cut at 255 characters by the DNS panel, with the end lost.
• Quotes inside quotes, like ""v=DKIM1..."".
• The p= part missing or empty: an empty key means "this key is revoked".

Last resort

If your DNS provider cannot store long records at all, consider moving your DNS to a better provider. Some email services also let you choose a 1024-bit key, which fits in one string, but it is weaker and should only be temporary.

Check that it is fixed

The dig command should show one record whose joined value matches your provider's key exactly. Then send a new test email from the home page: DKIM should pass for your domain.