Security finding
A DKIM key is 1024 bits or shorter
Security Warning Severity: Medium
Part of the audit Email authentication records. Finding id: security.emailDkimKeySize.
What it costs you
RFC 8301 asks for keys of at least 2048 bits. A short key is easier to break, and whoever breaks it can sign mail as your domain.
What to do
Create a 2048-bit key in the sending service, publish it under a new selector, switch signing to it, then remove the old record.
What it checks
- Email signing key is too short
How to fix it
Rotate to a 2048-bit key
- In the service that signs mail as [domain] with the selector [selector], generate a new DKIM key of 2048 bits. Most services let you choose the size.
- Publish the TXT record the service gives you under a new selector, and switch signing to it.
- When mail is signed with the new selector, empty the p= value of the old record or delete it.
How to check: dig +short TXT [selector]._domainkey.[domain] (the old selector is gone or has an empty p=)
Thresholds
| Name | Default | Meaning |
|---|---|---|
weak_dkim_bits | 1024 | An RSA DKIM key of this many bits or fewer is reported. From RFC 8301, which asks for at least 2048. |