webzod
account

Replace the weak DKIM key with a 2048-bit key on Cloudflare

email.dkim.weak_key · effort: about an hour

Why it matters

A DKIM key shorter than 1024 bits can be broken with modest computing power, which lets an attacker forge signed mail from your domain. Receivers must treat signatures from a key under 1024 bits as invalid, so this selector already fails DKIM.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Generate the new 2048-bit key in the mail service first (it shows you the selector name and the value to publish). Examples: Google Workspace Admin console > Gmail > Authenticate email; Microsoft 365 Rotate-DkimSigningConfig -KeySize 2048.
  2. In the Cloudflare dashboard open DNS > Records and choose Add record. Type TXT, Name the selector name the service gave you (for example 2026a._domainkey), Content the value it shows, then save. Cloudflare adds the quotes and splits long values.
  3. If the service gives you CNAME records instead of a TXT (Microsoft 365 does), add them as CNAME and set Proxy status to DNS only (grey cloud). A proxied DKIM CNAME will not work. (Microsoft 365: keep both selector1 and selector2 CNAMEs.)
  4. Turn signing on with the new selector in the mail service, send a test message and check for dkim=pass. After about a week, edit the old selector's TXT record so its Content is v=DKIM1; p= (revoked) rather than deleting it.
text 
Type:     TXT
Name:     2026a._domainkey.example.com
Content:  v=DKIM1; k=rsa; p=<PUBLIC KEY FROM YOUR MAIL SERVICE>

# After about a week, old weak selector, Content (revokes the key):
# v=DKIM1; p=

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.