Guides · Updated 2026-10-11

DKIM key length and rotation: 1024 vs 2048 bits

RFC 8301 says signers must use RSA keys of at least 1024 bits and should use at least 2048 bits. Google Workspace, Microsoft 365 and most ESPs now support 2048-bit keys.

Why 2048 can be tricky

A 2048-bit key is longer than 255 characters, so the TXT record must be split into multiple strings. Most DNS hosts handle this automatically; some older ones don't.

Rotation

1. Publish the new key under a new selector.
2. Switch signing to the new selector.
3. Wait a few days for in-flight mail, then revoke the old key by publishing it with an empty p=.

Providers using CNAME delegation (Microsoft 365, SendGrid, SES) can rotate for you automatically.

Sources

• RFC 8301
• RFC 6376: DKIM Signatures
• Google Workspace: Set up DKIM

This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.