DKIM Key Size: 1024 vs 2048 Bits - Which Should You Use?

See all our email authentication comparisons.

When generating DKIM keys, you must choose a key size. The two common options are 1024 bits and 2048 bits. If you are new to DKIM, our complete guide covers the fundamentals. Here's what you need to know about key sizes.

Quick Comparison

Security Considerations

1024-bit Keys

1024-bit RSA keys were standard for years but are now considered weak:

• Theoretically breakable with sufficient computational resources
• NIST deprecated 1024-bit RSA in 2013
• RFC 8301 (2018) recommends against 1024-bit DKIM keys
• Some security audits flag 1024-bit keys as vulnerabilities

A 1024-bit key hasn't been publicly broken for DKIM purposes, but the security margin is shrinking.

2048-bit Keys

2048-bit RSA provides substantially stronger security:

• 128-bit security level - considered secure through 2030+
• Industry standard for DKIM, TLS certificates, and more
• Required by some compliance frameworks
• Recommended by Google, Microsoft, and email security experts

The computational cost to break a 2048-bit key is approximately 2^32 times harder than 1024-bit.

DNS Record Size

The practical challenge with larger keys is DNS record length.

1024-bit DNS Record

selector._domainkey TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."

• Approximately 180 characters for the public key
• Fits easily in a single DNS TXT record
• No compatibility issues

2048-bit DNS Record

selector._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

• Approximately 400 characters for the public key
• May require splitting across multiple strings -- see DKIM record examples for formatting details
• Some older DNS providers have issues

Splitting Long Records

DNS TXT records have a 255-character limit per string. For 2048-bit keys, the record is split:

selector._domainkey TXT ("v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A"
                         "MIIBCgKCAQEA...rest of key...")

Most DNS providers handle this automatically. Receivers concatenate the strings when validating.

Provider Support

Providers Requiring 2048-bit

Some email services mandate 2048-bit keys:

• Google Workspace - 2048-bit default since 2016
• Microsoft 365 - 2048-bit recommended
• Proofpoint - 2048-bit required
• Many enterprise email gateways

DNS Providers With 2048-bit Issues

A few older or limited DNS providers struggle with long TXT records:

• Some budget hosting control panels
• Older on-premise DNS servers
• Certain registrar DNS services

If your DNS provider can't handle 2048-bit keys, consider:

1. Migrating DNS to a modern provider (Cloudflare, Route 53, etc.)
2. Using 1024-bit as a temporary measure while migrating
3. Contacting your provider about TXT record limits

Performance Impact

Key size affects signing and verification speed:

These differences are negligible for normal email volumes. Even high-volume senders (millions of emails/day) won't notice meaningful performance impact from 2048-bit keys.

When to Use 1024-bit

Despite the recommendation for 2048-bit, there are limited cases for 1024-bit:

1. DNS provider limitation - Provider truly cannot support long TXT records
2. Legacy system constraint - Older mail server software with hardcoded limits
3. Temporary migration - Short-term use while upgrading infrastructure

If using 1024-bit, plan to migrate to 2048-bit within 6-12 months.

When to Use 2048-bit

Use 2048-bit keys for:

• New deployments - Start with current standards
• Production email - Anything customer-facing
• Compliance requirements - PCI-DSS, SOC 2, etc.
• Long-term use - Keys you won't rotate frequently

Key Rotation Strategy

Key size choice affects rotation planning. For a deeper look at rotation best practices, see our DKIM key rotation guide.

1024-bit Strategy

If forced to use 1024-bit:

• Rotate every 6 months
• Plan migration to 2048-bit
• Monitor security advisories

2048-bit Strategy

• Rotate annually or on security events
• Standard practice for most organizations
• No urgent migration pressure

Migration Path

Moving from 1024-bit to 2048-bit:

What About 4096-bit?

Some wonder about even larger keys:

• Not recommended for DKIM currently
• DNS record would be ~800 characters - compatibility issues
• Performance overhead increases significantly
• 2048-bit provides sufficient security for foreseeable future
• Consider algorithm change (Ed25519) before key size increase

Future: Ed25519

DKIM supports Ed25519 (elliptic curve) as an alternative to RSA:

Ed25519 offers equivalent security with much smaller keys. However, support isn't yet universal. For now, RSA 2048-bit remains the safe choice.

Recommendation

Use 2048-bit keys unless you have a specific, documented reason not to.

The security improvement over 1024-bit is substantial, performance impact is negligible, and DNS compatibility is nearly universal. Starting with 2048-bit avoids future migration work.

References

• RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
• RFC 8301 — Cryptographic Algorithm and Key Usage Update to DKIM

---

Generate secure 2048-bit DKIM keys in your browser.