uSend Docs
Guides

DKIM keys and 2048 bits

Why usend uses 2048-bit DKIM keys and how to publish a long TXT value.

DKIM signs each message with a private key; receivers fetch the public key from DNS and check the signature. usend generates a 2048-bit RSA key for every domain, signs with it, and gives you the public half as a TXT record at rs1._domainkey (the exact name is on the domain's page).

Why 2048 bits

1024-bit keys are short enough to be considered weak, and large providers recommend 2048 bits. A 2048-bit key resists attacks well beyond today's capacity, with no downside for senders beyond a longer DNS value.

The long value

A 2048-bit public key makes the record longer than 255 characters. A single DNS string holds at most 255 characters, so the value is stored as several strings in one TXT record. Most DNS providers do this automatically when you paste the whole value. Some need help:

  • Paste the whole value in one field and let the provider split it. This works on most providers.
  • If the provider asks for quoted strings, split the value into chunks of up to 255 characters and quote each: "v=DKIM1; k=rsa; p=MIIBIjAN..." "...rest of key..." on one line. Resolvers join the strings, and usend verifies it that way.
  • Do not add spaces or line breaks inside the key. A stray character invalidates the signature.
  • If the provider refuses long TXT values, move the zone to one that supports them, or ask its support: this is standard DNS.

Provider specifics: DNS guides.

Checking the record

Shell
dig +short TXT rs1._domainkey.acme.com

You should see a value starting with v=DKIM1; k=rsa; p=. If it comes back empty, the record is not published at that exact name; if it looks cut off, the provider truncated it.

Key management

  • The private key is stored encrypted by usend and never shown. You publish only the public key.
  • Do not publish two different keys at the same selector.
  • Keep the record in place for as long as you send from the domain. If it disappears, the domain stays verified for 72 hours while usend keeps checking, then sending from it stops: see Verify a domain.

See also: Domain not verifying.