Why Short DKIM Keys Are a Security Risk Even When DMARC Passes

The False Security of a DMARC Pass

Your email passes DMARC. SPF is aligned. DKIM is aligned. The receiving server accepts the message. You call that a win and move on.

But if the DKIM key used to sign that message is 1024 bits long, the win is thinner than it looks.

DMARC checks whether the RFC5321.From domain aligns with the domain that authenticated the message via SPF or DKIM. It does not check whether the DKIM key used to authenticate is cryptographically adequate for 2026. Those are two separate questions - and operators often answer the first while ignoring the second.

How DKIM Key Size Relates to Security

DKIM signs emails using RSA keys. The key size determines how much work is required to recover the private key from the public key. A 1024-bit RSA public key contains enough information to derive the private key by factoring the modulus. Once an attacker has the private key, they can sign emails that appear to come from your domain - and those forged signatures will pass DKIM checks.

2048-bit RSA keys are not forgeable with current publicly known methods and commodity cloud hardware. 1024-bit RSA keys are.

The mathematics is not new. RSA key factoring has been studied since the 1970s. What changed is the cost of compute. In 2026, factoring a 1024-bit RSA key on cloud hardware costs roughly $50-$200 depending on the provider and the implementation. This is not nation-state budget territory. This is a motivated individual with a cloud account.

What It Actually Costs to Factor a 1024-bit RSA Key in 2026

The CADO-NFS project and similar open-source implementations can factor 1024-bit RSA keys on clusters of commodity machines. On a single modern CPU core, factoring a 1024-bit key takes roughly 30-70 CPU-years. But the work is embarrassingly parallel - and cloud providers sell thousands of cores by the hour.

Using a task queue with 1000 cores, the same factoring job runs in 1-2 months of wall-clock time for around $50-$100 in compute costs. With 10,000 cores, it finishes in a few days.

These are not theoretical numbers. Academic papers from 2019 and 2020 already demonstrated 1024-bit factoring at roughly $20,000-$40,000 in cloud costs. Prices have dropped since then. The attack is not theoretical for any adversary with a budget above a few hundred dollars and moderate technical skill.

2048-bit RSA keys are not factored this way with any publicly known method. Breaking a 2048-bit key with the best known algorithm - General Number Field Sieve - would take roughly 300 trillion CPU-years at current compute pricing. It is not happening.

The Attack Chain - From Key Factor to Forged Email

Here is how the attack works in practice:

1. Attacker identifies a domain sending legitimate email with a 1024-bit DKIM key.
2. Attacker crawls DNS for the DKIM selector record (dig TXT selector._domainkey.example.com) and extracts the 1024-bit modulus.
3. Attacker factors the modulus offline, recovering the DKIM private key.
4. Attacker crafts an email purporting to be from the target domain, signs it with the recovered key.
5. The forged DKIM signature passes validation. The RFC5321.From domain is aligned with the signing domain. DMARC passes.
6. The email lands in the recipient's inbox with full DMARC alignment, indistinguishable from legitimate outbound mail.

This is not a parser bug or a misconfiguration. This is the crypto itself being too weak for the threat model.

How to Check Your DKIM Key Size

Run this from any DNS-capable machine:

dig TXT default._domainkey.example.com TXT

Or for other selectors:

dig TXT selector._domainkey.example.com TXT

Look for the RSA key in the record. A 1024-bit key base64-encoded is roughly 172 characters. A 2048-bit key is roughly 344 characters. If your DKIM record is under 200 characters, you are almost certainly running 1024-bit RSA.

Most large email providers (Google, Microsoft, Fastmail) now use 2048-bit DKIM keys by default. Many smaller operators and some legacy systems still use 1024-bit.

What Minimum Key Length Should You Use Now

Use 2048-bit RSA as your minimum DKIM key length today. 1024-bit is acceptable only for low-risk, low-volume domains where you have assessed the threat model and accepted the residual risk - and you should be migrating those to 2048-bit anyway.

For long-term algorithm agility, watch the transition toward Ed25519 for DKIM (defined in RFC 8463). Ed25519 keys are roughly 256 bits and are not vulnerable to RSA-style factoring attacks. Adoption is still early, but if you are building new email infrastructure, designing for algorithm agility now saves a migration later.

Key rotation is also worth doing on a schedule, not just when you suspect compromise. If a 1024-bit key is rotated before anyone factors it, the attack becomes moot. Most major providers rotate DKIM keys every 30-90 days automatically.

How DMARCFlow Fits Into This

DMARCFlow monitors DKIM key sizes across your tracked domains and alerts you when a domain's DKIM key falls below 2048 bits. This is part of the broader authentication health picture - DMARC passing tells you alignment is satisfied; DMARCFlow tells you whether the underlying signing key is adequate for current threat models.

If you are managing a portfolio of sending domains and you have not checked DKIM key sizes recently, add that to the queue. It takes an hour to audit and a migration to 2048-bit is operationally straightforward - most providers handle it transparently.

Frequently Asked Questions

If DMARC passes, why does the key size matter?

DMARC checks alignment. It does not check the strength of the cryptographic key used to sign. A 1024-bit DKIM signature can pass DMARC alignment while being forgeable. The receiving server correctly validates that the message was signed by your DKIM key - but if that key has been factored, the attacker signed it, not you.

Does changing my DKIM key size require changing my email infrastructure?

Usually not. Most email providers handle DKIM key rotation transparently through their control panels or DNS settings. You generate a new 2048-bit key pair, publish the public half as a DNS TXT record, and update your email system's signing configuration. The process typically takes under an hour for a single domain.

Is 2048-bit RSA too slow for high-volume email signing?

No. RSA signing overhead is negligible at normal email volumes. The computational cost of a 2048-bit RSA sign operation is measured in microseconds on modern hardware and does not meaningfully affect email processing throughput. Google, Microsoft, and Fastmail all use 2048-bit DKIM at scale.

What about 4096-bit DKIM keys?

4096-bit RSA works for DKIM, but the practical security gain over 2048-bit is minimal for the email use case, while the DNS record size and parsing overhead are notably higher. 2048-bit is the current industry minimum recommendation from NIST and is considered adequate for email authentication through at least 2030.

How do I know if my DKIM key has already been compromised?

You likely do not. Factoring a DKIM key and using it silently for targeted impersonation does not produce obvious signs - there is no breach notification, no failed authentication, and no DMARC failure to alert you. Monitoring for unusual authenticated sending patterns and rotating DKIM keys periodically are the best mitigations available.