DKIM key too short (<1024 bits)
Your DKIM public key is shorter than 1024 bits. Modern receivers reject or ignore signatures below this threshold.
Gmail, Microsoft 365, and Yahoo all treat sub-1024-bit DKIM keys as unsigned. You lose the signature entirely, which cascades into DMARC alignment failure.
What causes it
- You generated a 512-bit key in 2010 and never rotated it.
- Your mail provider still defaults to 1024 but you forgot to upgrade to 2048.
- Your DNS provider truncated a long TXT record and the resulting key is malformed.
How to fix it
Step 1: Generate a new 2048-bit key
Both OpenDKIM and all major mail services support 2048-bit keys. 2048 is the current recommended minimum; 4096 is overkill for most domains and may exceed DNS TXT limits.
opendkim-genkey -b 2048 -s selector2 -d yourdomain.comStep 2: Publish the new public key under a new selector
Use a new selector name (e.g., selector2) so you can run both old and new simultaneously during the transition. Only switch your signer to the new selector once DNS has propagated.
Step 3: Decommission the old selector
After a week of successful sends on the new selector, delete the old DNS record and remove the old key from your mail server.
Fixed it? Run a fresh test to confirm.
Test my inbox →