1024-bit vs 2048-bit DKIM Keys

Why key size matters

DKIM uses RSA keys to sign and verify messages. The security of the signature depends on the difficulty of factoring the RSA key. A 1024-bit key was adequate when DKIM was first deployed, but computing power has increased significantly. 1024-bit RSA is now considered below the minimum acceptable security level by most security standards bodies.

Google explicitly flags 1024-bit DKIM keys in their guidelines for email senders. Some receiving systems may penalize or flag mail signed with weak keys.

How to check your current key size

The key size is encoded in the DKIM public key record in DNS. You can look it up with a DNS query. At the command line:

nslookup -type=TXT selector1._domainkey.yourdomain.com

Or use a DKIM lookup tool. In the result, look for the p= field — the base64-encoded public key. A 1024-bit key produces roughly 172 characters in base64. A 2048-bit key produces roughly 344 characters. If you're not sure, generate a key and compare.

Your mail platform or DKIM setup interface may also show the key size directly when you view an existing key.

Where your DKIM key comes from

DKIM keys are generated by the system doing the signing — not by you directly. Where you get the key depends on how your email is sent:

Managed email platforms (Google Workspace, Microsoft 365, SendGrid, Mailchimp, HubSpot, etc.)
Log into the platform's admin or authentication settings and locate the DKIM section. The platform generates the key pair internally, holds the private key, and gives you a DNS TXT or CNAME record to publish in your domain's DNS. You don't handle the private key at all — the platform uses it automatically when signing outbound mail.

Self-managed mail servers (Postfix, Exim, etc.)
You generate the key pair yourself, typically using openssl:

openssl genrsa -out dkim-private.pem 2048
openssl rsa -in dkim-private.pem -pubout -out dkim-public.pem

The private key goes into your mail server's DKIM signing configuration (e.g., OpenDKIM or rspamd). The public key is extracted and published as a DNS TXT record under your selector. Keep the private key file secure — if it's compromised, anyone can forge signatures for your domain.

If you can't find the DKIM setting: Check your mail platform's documentation for "DKIM setup" or "email authentication." Every major platform supports it, but the menu location varies. Some platforms call it "domain authentication" or "sender authentication."

Rotating to 2048-bit without breaking delivery

DKIM key rotation is safe to do without downtime if you follow the right sequence. The key is that old signatures from the previous key remain valid until they expire — typically 5–7 days after the message was signed. As long as you don't remove the old key immediately, messages in transit will still verify.

1. Generate a new 2048-bit key pair in your mail platform or DKIM tool. Most platforms let you create a new key with a new selector name (e.g., selector2).
2. Publish the new public key in DNS at the new selector: selector2._domainkey.yourdomain.com.
3. Wait for DNS propagation — typically a few hours, up to 48 hours.
4. Update your mail server or platform to use the new private key for signing.
5. Keep the old key live in DNS for at least 5–7 days to allow in-flight messages to verify.
6. Remove the old key record from DNS after the grace period.

1024-bit and DNS TXT record size limits

Some DNS providers have issues with long TXT records. A 2048-bit DKIM public key is a long string, and some providers require it to be split into multiple 255-character chunks within the TXT record value. If your DNS provider uses a web interface, check whether it handles long TXT records correctly. If records are truncated, DKIM verification will fail.

The correct format for a split record looks like this:

"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQ" "EFAAOCAQ8AMIIBCgKCAQEA..."

Multiple quoted strings in a single TXT record are concatenated by DNS resolvers. Most modern DNS providers handle this automatically.

Platforms that still default to 1024-bit

Some older or simpler mail platforms still generate 1024-bit keys by default. When setting up DKIM on any platform, look for a key size option and select 2048-bit if available. If 2048-bit is not available, it's a limitation of that platform worth knowing about.