DKIM key is only 1024 bits
What this check looks for
Your signing key still works, but it is at the minimum size the standard allows. Larger keys are now the norm and some receivers treat 1024-bit signatures as weak.
Why it matters
Rotating to a 2048-bit key is routine maintenance today; leaving it is a slow drift towards the key being rejected outright.
When the check passes, your report says: “The DKIM key is comfortably above the 1024-bit minimum”.
What it costs your score
When this check fails it removes 5 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.dkim family ceiling of 30 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 5 points
- Family cap
- email-auth.dkim · 30
- Category
- Email authentication
- Module
- Email dkim
- Fix owned by
- mail provider
- In the ruleset since
- 2026.09
How to fix it
Rotate to a 2048-bit key at the next convenient maintenance window.
1024-bit keys are at the standard's floor and are increasingly treated as weak.
Generate a 2048-bit key pair under a new selector.
Publish it, switch signing to the new selector, then retire the old record after a week.
How to confirm it worked
dig +short TXT ‹selector›._domainkey.‹domain› — the p= value must decode to 2048 bits
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The key at ‹selector›._domainkey.‹domain› is 1024 bits. RFC 8301 §3.2 sets 1024 as the floor and recommends 2048; the practical limit is that a 2048-bit key still fits in a single DNS TXT record once chunked, so there is little reason not to use one.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.