DKIM Key Length & Cryptographic Strength Auditor
Inspect RFC 6376 DKIM selector records, decode public key bit lengths, identify obsolete 1024-bit RSA signing, and verify 2048-bit RSA and Ed25519 compliance for inbox deliverability.
Frequently Asked Questions
Why are 1024-bit RSA DKIM keys now considered vulnerable and deprecated?
Advancements in cloud compute and factoring algorithms mean that 1024-bit RSA keys can be factored with modest computing resources. Since 2024, major email providers including Google and Yahoo flag or down-rank messages signed with 1024-bit keys. The current cryptographic minimum for email authentication is 2048-bit RSA or Ed25519.
How are DKIM selectors queried in DNS?
DKIM public keys are published as DNS TXT records at the subdomain selector._domainkey.yourdomain.com. Because selectors are arbitrary strings chosen by the email sender (e.g., google, k1, s1), scanning tools probe common known selector patterns to discover published keys.
What is Ed25519 in DKIM and what are its advantages over RSA?
Defined in RFC 8463, Ed25519 is an Edwards-curve digital signature algorithm offering equivalent or superior security to 3072-bit RSA while requiring tiny public keys and ultra-fast verification times, fitting comfortably within standard 512-byte UDP DNS packet limits.
How does an obsolete DKIM key compromise outbound email deliverability?
Receiving mail transfer agents that detect weak 512-bit or 1024-bit DKIM signatures may penalize sender reputation scores, treat authentication as failed, or route messages directly to spam quarantine folders.