HighAuthentication · usually high
DKIM key is shorter than 1024 bits
The RSA key is too short to be considered secure and some receivers reject it.
Check your own domain
What causes this
RSA keys below 1024 bits are computationally feasible to break, which would let an attacker forge valid signatures for your domain. RFC 6376 requires verifiers to support 512 to 2048 bits, but modern receivers commonly refuse keys under 1024 outright.
What it breaks
Signatures may be treated as invalid, and a short key is a genuine forgery risk rather than a theoretical one.
How to fix it
Rotate to a 2048-bit key.
- Generate a new 2048-bit DKIM key in your sending provider's console.
- Publish the new record at a new selector.
- Switch signing to the new selector.
- Revoke the old selector once no mail is signed with it.
Specification: RFC 6376 — DomainKeys Identified Mail
Related problems
- No DKIM key found at the selectors we checkedWe probed the selectors used by common providers and found no DKIM record.
- DKIM record is malformedThe record at this selector is not a valid DKIM key record.
- No DMARC record foundThere is no DMARC policy at _dmarc for this domain.
- DMARC record contains a syntax errorA tag in the DMARC record is malformed, which can invalidate the whole policy.
- More than one DMARC record publishedMultiple DMARC records exist at _dmarc, so receivers ignore the policy entirely.