DKIM Record Too Long: How to Fix DNS Length Limits

You generated a DKIM key, pasted it into your DNS provider, and got an error. The record is too long. This is one of the most common issues with DKIM setup, and it has straightforward fixes.

Browse all Troubleshooting guides.

Why DKIM Records Get So Long

DKIM records contain a public key encoded in base64. The length of that key depends on the key size you chose when generating it.

A 1024-bit key produces a public key string of roughly 216 characters. When you add the required DKIM tags (v=DKIM1; k=rsa; p=...), the full record value comes to around 240 characters. That fits comfortably within DNS limits.

A 2048-bit key, which is the recommended standard today, produces a public key string of roughly 392 characters. With the DKIM tags included, the full record value is around 420 characters. That exceeds the DNS string limit.

The DNS 255-Byte String Limit

DNS TXT records have a technical constraint: each individual string within a TXT record can be at most 255 bytes long. This limit comes from the original DNS specification (RFC 1035), which uses a single byte to store the length of each string.

Your 2048-bit DKIM record is around 420 characters. Since that exceeds 255 bytes, it cannot be stored as a single string. This is where the "record too long" errors come from.

The good news is that DNS does support longer TXT records. The total record can be up to 65,535 bytes. The trick is that the value needs to be split into multiple strings of 255 characters or fewer, and the receiving system concatenates them back together.

How TXT Record String Concatenation Works

DNS allows a TXT record to contain multiple strings. When a mail server looks up your DKIM record, it reads all the strings and joins them together in order. The result is the complete DKIM record value, as if it were stored as one piece.

In raw DNS format, a split record looks like this:

"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu5zKbqKtvkWJpb9YgVjCCXHSBRfLQJxZyPBnomx8M5yqHk7Q9rP9z8NFMH9YkMcYxRAE8o9kDc+LNhxeZx5Rk6aTtcWvoIgGhLxnlxOYSrJjFJh8knRvGLqhfhbdP0mYgVaIa7GT" "v5JkW5vP3qXWmFBQD7kzE6RhG8o3d5LmVpAkt+EdfLXQqz8kP7sM5GHXaQUpJ6FdR5+8aBTMNE8MQUIDAQAB"

Each quoted section is its own string, each under 255 characters. The mail server reads them in order and treats the whole thing as a single value.

How DNS Providers Handle Long Records

This is where things get tricky. Different DNS providers handle splitting differently.

How to Split Your DKIM Record Manually

If your DNS provider does not auto-split, you need to break the record into quoted strings yourself.

Use CNAME Records as an Alternative

Some email providers solve the length problem entirely by using CNAME records instead of TXT records. With this approach, your DNS record is a short CNAME that points to the provider's own DNS, where they host the full public key.

For example, Microsoft 365 uses CNAME records like this:

selector1._domainkey.example.com  CNAME  selector1-example-com._domainkey.example.onmicrosoft.com

The CNAME itself is short and fits easily within DNS limits. The actual long DKIM key lives on Microsoft's DNS servers.

If your email provider offers a CNAME option for DKIM, it is usually the simplest path. You avoid length issues entirely and the provider can rotate keys on their end without you touching your DNS again.

When to Use 1024-Bit Keys as a Fallback

If your DNS provider simply cannot handle a 2048-bit key, even with splitting, a 1024-bit key is a reasonable fallback. A 1024-bit DKIM key is still far better than no DKIM at all.

Consider using 1024-bit keys when:

• Your DNS provider has a hard limit that prevents long TXT records
• You are on a legacy hosting plan with restricted DNS management
• You need a quick fix while migrating to a provider that supports longer records

Provider-Specific Notes

Cloudflare handles long TXT records well. Paste the full value without quotes and Cloudflare splits it internally.

GoDaddy has improved its handling of long records, but older interfaces may still have issues. If your record is not verifying, try splitting it manually with quotes.

Route 53 (AWS) requires you to wrap the value in quotes. For long records, use multiple quoted strings within the same TXT record value field.

Namecheap has a character limit in their DNS management panel. If you hit it, contact their support for assistance or consider using Cloudflare as your DNS provider while keeping Namecheap as your registrar.

cPanel behavior varies depending on the hosting provider and cPanel version. Some newer versions handle splitting automatically. Test after saving.

Quick Checklist

1. Generated a 2048-bit key? Expect the record to be around 420 characters
2. Getting a "too long" error? Split into quoted strings of 255 characters or fewer
3. Record saved but DKIM failing? Check if your provider truncated the value silently
4. Provider cannot handle long records? Use CNAME-based DKIM or fall back to 1024-bit
5. Not sure if it worked? Verify with a DNS lookup tool after saving

References

• RFC 1035 — Domain Names - Implementation and Specification

---

Need DKIM keys that work with your DNS provider? Generate them with DKIM Creator.