Replace the weak DKIM key with a 2048-bit key

Why it matters

A DKIM key shorter than 1024 bits can be broken with modest computing power, which lets an attacker forge signed mail from your domain. Receivers must treat signatures from a key under 1024 bits as invalid, so this selector already fails DKIM.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Generate a new 2048-bit DKIM key in the service that signs your mail (your mail provider, newsletter tool and so on). The DKIM key lives with the sender, so the change is made in that service, not in DNS alone. Examples: in Google Workspace use Admin console > Apps > Google Workspace > Gmail > Authenticate email and generate a 2048-bit key; in Microsoft 365 run Rotate-DkimSigningConfig -Identity yourdomain -KeySize 2048 (it publishes through two CNAME selectors you already have). Follow the provider's current instructions.
2. Publish the new public key in DNS under a new selector name (for example a date such as 2026a) before switching signing to it. Keep the old selector until the new one is signing.
3. Switch the service to sign with the new selector, send a test message to an address at another provider, and check the headers show dkim=pass for your domain with the new selector.
4. After about a week, retire the old weak selector: prefer revoking it by publishing an empty key (p= with nothing after it, see the snippet) over deleting the record, because a revoked key tells receivers explicitly that it must not verify. (Microsoft 365: keep both selector1 and selector2 CNAMEs; do not delete or revoke them.) Repeat for every service that signs as your domain.
5. A 2048-bit key is longer than 255 characters, so the TXT value is stored as several quoted strings that receivers join together; most DNS panels do this automatically, otherwise paste the provider's value exactly as shown.

; New selector, name chosen by you; paste the public key your mail service shows (p=...)
; A 2048-bit key is split into quoted strings of at most 255 characters each, joined by receivers
2026a._domainkey.example.com.  IN TXT  ( "v=DKIM1; k=rsa; " "p=<FIRST PART OF THE PUBLIC KEY>" "<REST OF THE PUBLIC KEY>" )

; After about a week, revoke the old weak selector (an empty p= revokes the key)
; OLD-SELECTOR._domainkey.example.com.  IN TXT  "v=DKIM1; p="

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DKIM selectors check
• Check that your mail is signed with DKIM
• Rotate the 1024-bit DKIM key to 2048 bits
• Fix the unusable DKIM key record
• Check that revoked DKIM selectors are meant to be revoked
• Take the DKIM selector out of testing mode