Definition
DKIM bit length is the size, measured in bits, of the cryptographic key pair used to create and verify a DKIM signature. The public key is published in DNS while the private key signs outgoing mail. Key length is a direct trade-off between security and compatibility: longer keys are harder to break, while shorter keys have broader legacy support.
How It Works
DKIM keys are typically RSA key pairs, and the two standard sizes are:
| Bit length | Security | Compatibility |
|---|---|---|
| 1024 bits | Weaker, no longer considered secure | Broad, including some legacy systems |
| 2048 bits | Strong, current recommendation | Near-universal among modern providers |
The signing process is the same regardless of length, but a longer key produces a larger signature and requires more processing to verify. In the past, 1024-bit keys were common for compatibility, but today the ecosystem has largely moved to 2048 bits.
Why It Matters
Key length affects both security and deliverability. A 1024-bit key is now considered too weak to withstand modern factoring attacks, and major mailbox providers expect 2048-bit keys as a baseline. Consequences of using an outdated key length include:
- Reduced confidence from receiving servers, since weak keys are a security risk.
- Potential filtering by providers that flag short keys as non-compliant.
- Increased vulnerability to signature forgery if the key is ever factored.
Most email authentication guidance now recommends 2048-bit keys for all new DKIM deployments, and rotating any existing 1024-bit keys to 2048 bits. When rotating, the change should follow normal DKIM rotation practice to avoid breaking signatures on mail in flight.
Some platforms additionally support 4096-bit keys, though these offer marginal security benefit over 2048 for email and increase DNS record size, so 2048 remains the practical standard.
Example
A SaaS company discovers its DKIM key is 1024 bits, carried over from an old setup. During its next rotation, it generates a 2048-bit key pair, publishes the new public key under a fresh selector, and retires the old key after a transition period. Its messages now meet provider expectations for key strength.
Was this useful?
Related Glossary Terms
Apple App Password (Email)
An Apple app password is a generated, app-specific password used to sign into an email account through clients that do not support two-factor authentication.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
DKIM Alignment
DKIM alignment is the DMARC requirement that the domain in the From header matches the domain in the DKIM signature, confirming the visible sender domain is authenticated.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
DMARC Aggregate Report
A DMARC aggregate report is a machine-readable XML summary that receiving mail servers send to domain owners daily to show authentication results for their email traffic.
Frequently Asked Questions
2048 bits is the current recommendation for all new and rotated DKIM keys. It balances strong security with broad compatibility and meets mailbox provider expectations.
They are increasingly discouraged. While some legacy systems still accept them, major providers treat 1024-bit keys as weak, and senders should rotate them to 2048 bits.
The processing difference is negligible for email volumes. A 2048-bit key adds slightly larger signatures, but the impact on delivery speed is not meaningful in practice.
Not directly. DMARC relies on DKIM passing and aligning, which a longer key does not change. Using a weak key length can, however, affect provider trust and thus filtering, indirectly influencing DMARC outcomes.