Rotate the 1024-bit DKIM key to 2048 bits on Cloudflare

Why it matters

1024-bit DKIM keys are still accepted, but the standard recommends 2048 bits and 1024-bit keys are within reach of well-funded attackers. Rotating is a routine change if you publish the new key before switching to it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Generate the 2048-bit key in the mail service first; it shows you the selector name and value.
2. In the Cloudflare dashboard open DNS > Records > Add record. Type TXT, Name the selector (for example 2026a._domainkey), Content the value from the service. Save.
3. If the service uses CNAME records for DKIM, add them with Proxy status DNS only (grey cloud). (Microsoft 365: keep both selector1 and selector2 CNAMEs.)
4. Switch signing to the new selector and test. After about a week, edit the old selector's TXT record so its Content is v=DKIM1; p= (revoked) rather than deleting it.

Type:     TXT
Name:     2026a._domainkey.example.com
Content:  v=DKIM1; k=rsa; p=<PUBLIC KEY FROM YOUR MAIL SERVICE>

# After about a week, old 1024-bit selector, Content (revokes the key):
# v=DKIM1; p=

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DKIM selectors check
• Check that your mail is signed with DKIM
• Replace the weak DKIM key with a 2048-bit key
• Fix the unusable DKIM key record
• Check that revoked DKIM selectors are meant to be revoked
• Take the DKIM selector out of testing mode