DKIM key is shorter than 1024 bits
What this check looks for
The signing key published for your domain is too small to be trusted. Receiving servers are told to reject keys this short, so your signature may be treated as if it were not there.
Why it matters
A key this short can be broken by an attacker with modest resources, who could then sign mail that appears genuinely from you.
When the check passes, your report says: “The DKIM key meets the minimum size receivers accept”.
What it costs your score
When this check fails it removes 15 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.dkim family ceiling of 30 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 15 points
- Family cap
- email-auth.dkim · 30
- Category
- Email authentication
- Module
- Email dkim
- Fix owned by
- mail provider
- In the ruleset since
- 2026.09
How to fix it
Generate a 2048-bit key pair under a new selector and rotate to it.
Verifiers must treat keys below 1024 bits as invalid, so the signature does not count.
Generate a new 2048-bit RSA key pair under a fresh selector (never overwrite the live one).
Publish the new public key and wait for it to propagate.
Switch your mail server or provider to sign with the new selector.
After a week with no legitimate mail signed by the old selector, delete the old record.
How to confirm it worked
dig +short TXT ‹selector›._domainkey.‹domain› — the p= value must decode to a 2048-bit key
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Remediation by platform
opendkim-genkey -b 2048 -d ‹domain› -s ‹new selector› -D /etc/opendkim/keys/‹domain›/Technical detail
The key at ‹selector›._domainkey.‹domain› is ‹key bits› bits. RFC 8301 §3.2 requires signers to use RSA keys of at least 1024 bits and verifiers to treat keys below 1024 bits as invalid, which produces a permerror rather than a failed signature.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.