Rotate the 1024-bit DKIM key to 2048 bits
Why it matters
1024-bit DKIM keys are still accepted, but the standard recommends 2048 bits and 1024-bit keys are within reach of well-funded attackers. Rotating is a routine change if you publish the new key before switching to it.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Generate a new 2048-bit key in the service that signs your mail. Examples: Google Workspace Admin console > Apps > Google Workspace > Gmail > Authenticate email; Microsoft 365 Rotate-DkimSigningConfig -Identity yourdomain -KeySize 2048 (applies to the next selector on first rotation, rotate again to move both). Use the provider's current instructions.
- Publish the new public key under a new selector name before switching signing to it, and leave the old selector in place.
- Switch signing to the new selector, send a test to another provider and check the headers for dkim=pass with the new selector.
- After about a week, retire the old 1024-bit selector: prefer revoking it by publishing an empty key (p= with nothing after it) over deleting the record. (Microsoft 365: keep both selector1 and selector2 CNAMEs.) Do the same for each service that signs as your domain.
- The 2048-bit value is longer than 255 characters and is stored as multiple quoted strings that receivers join together; most DNS panels do this for you.
dns
; New selector, name chosen by you; paste the public key your mail service shows (p=...) ; A 2048-bit key is split into quoted strings of at most 255 characters each, joined by receivers 2026a._domainkey.example.com. IN TXT ( "v=DKIM1; k=rsa; " "p=<FIRST PART OF THE PUBLIC KEY>" "<REST OF THE PUBLIC KEY>" ) ; After about a week, revoke the old 1024-bit selector (an empty p= revokes the key) ; OLD-SELECTOR._domainkey.example.com. IN TXT "v=DKIM1; p="
The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.