Use a 2048-bit RSA key for DKIM if your DNS host and signing service support it. RFC 8301 says signers MUST use at least 1024 bits and SHOULD use at least 2048. Verifiers must not treat signatures from keys shorter than 1024 bits as valid. Gmail's sender guidance also asks for 1024 bits or longer.
What the standard says
RFC 8301 updated the original DKIM specification. Before it, the guidance recommended 1024 to 2048 bits but required verifiers to accept 512-bit keys. The update closed that gap:
- Signers MUST use RSA keys of at least 1024 bits.
- Signers SHOULD use RSA keys of at least 2048 bits.
- Verifiers MUST be able to validate keys from 1024 to 4096 bits.
- Verifiers MUST NOT consider signatures from keys under 1024 bits valid.
It also retired the SHA-1 hash for DKIM. Use rsa-sha256.
Why the shorter key was common
The RFC is candid about it. Widely used DNS software had a practical limit of a single 256-octet string in a TXT record, and RSA keys much longer than 1024 bits do not fit in that. A 2048-bit public key is longer than one 255-character string, so it has to be split into several quoted strings inside the same TXT record.
Most modern DNS providers handle the split for you. Some control panels do not, and a pasted long key that is silently truncated gives a broken record.
Mailbox provider expectations
Google's sender guidelines say that sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer, and recommend a 2048-bit key if your domain provider supports it. Yahoo's sender page asks for a minimum 1024-bit key length as well.
So 1024 is the floor and 2048 is the target. A short key is a poor place to save effort, since you will rotate keys anyway.
How to move to 2048
- Check your signing service. Many let you pick key length when you generate a new selector.
- Generate the new key under a new selector name.
- Publish it and confirm it resolves as one TXT record, with all pieces present.
- Switch signing, test, then retire the old selector after a delay. The rotation guide has the order.
Quick check
Is a 1024-bit DKIM key broken?
No. It still meets the RFC 8301 minimum and Gmail and Yahoo accept it. It is the lower bound, and the RFC says 2048 is what signers should use.
Why not use 4096 bits?
Verifiers must handle up to 4096, but longer keys make the DNS record bigger and can hit DNS response size problems. 2048 is the usual balance. Check with your provider before going higher.
Sources
- RFC 8301, Cryptographic Algorithm and Key Usage Update to DKIM
- Google, email sender guidelines
- Yahoo Sender Hub, sender requirements
Last reviewed: 19 October 2026.
