Gmail sending out warnings for 512 bit DKIM keys

As an update to yesterday’s post, Gmail is contacting postmasters at domains signing with 512 bit keys to warn them of the upcoming changes. This message also clarifies “DKIM keys failing.” Messages signed with 512 bit keys or less will be treated as unsigned by Gmail in the next week or so.


We noticed that your domain is sending email to Gmail users that is DKIM signed with a 512-bit RSA key. RFC 6376 requires DKIM signing mail using RSA keys of at least 1024-bits for long-lived keys ( Shorter keys could be factored by an attacker. As you may know, this attack has been publicly reported. US-CERT has also issued an advisory to upgrade all keys lower than 1024-bits (

As such, we strongly encourage you to upgrade your RSA keys to be at least 1024-bits long.

To best protect our users, Gmail will begin treating emails signed with 512-bit keys as unsigned in about a week. If you continue to use your current key, your messages will not DKIM authenticate.

Affected key: descriptive text “k=rsa; p=AKDA3adkelLHaK653IuYD aVgIFc/FBvErvNOkCAwEAAQ==;”

Thank you,
Gmail Team


  1. Daniel Gibby says

    I think Google has incorrectly sent me the email. I updated my DKIM to a 1024 bit key this week; after which Google emailed me telling me that my new key was 512 bytes,but they included the new 1024 bit key in the email.

    I double checked that the key I am setup with is 1024 by using this tool, and it says it is 1024:

    Key Length (bits): 1024
    Key Type: rsa
    Public Key:


    That looks like a 1024 bit key to me. The 512 bit key was visibly shorter, about half as short in fact.

    I think Google may have looked through past email, but in the email sent out the current key, not the key that had been in the emails I sent before the upgrade.

  2. Neil Schwartzman says

    at least one of my accounts is losing email today (spamcop reports, password resets). Cause and effect? Time will tell.

  3. Neil Schwartzman says

    Update: there seemingly some significant delays with one of my Gmail accounts for at least the past 24 hours, but I did get the backlog all in a clump around 22:30 last evening. Doesn’t appear to be DKIM related, as spamcop user confirmation reports as signed by DK not DKIM (!)

  4. dialogue1 E-Mail-Marketing Blog says

    Gmail wird wählerisch bei DKIM…

    In wenigen Tagen beginnt Gmail damit, zu lasch verschlüsselte DKIM-Signaturen in E-Mails zu ignorieren – und wie fehlende Signaturen zu behandeln. (siehe Artikel in Word to the Wise) Damit sind vor allem 512-bit RSA-Schlüssel gemeint, die sich ja per B…

  5. Network Support Essex and London says

    Network Support Essex and London…

    Gmail sending out warnings for 512 bit DKIM keys – Word to the Wise…

  6. DKIM and Gmail – Word to the Wise says

    […] Gmail seem to be requiring in order for them to consider your mail DKIM signed, based either on statements from Google or watching what Gmail does with badly signed […]

  7. DKIM-Pflicht für CSA-zertifizierte E-Mails ab dem 10. Juni Campfire says

    […] groß sein. Empfohlen wird eine Stärke von mindestens 1014 Bit. Alles was darunter ist, behandelt Gmail als nicht signiert. Wer den Schlüssel knackt, kann unter fremdem Namen signierte Phishingmails versenden. Und der […]


Your email address will not be published. Required fields are marked *

  • Lost in the mists of time

    Over on the Farsight Security blog Joe St. Sauver talks about some of the early days of online abuse, on usenet. Laura and I were on the periphery of early usenet abuse, mostly as users, but Usenet (and IRC) around then were the places we both started with email abuse.No Comments

  • Ongoing Yahoo delays

    I've been hearing from folks over the last few days that they're seeing an uptick in deferrals from Yahoo! The deferrals are not uniform. ESPs report they're seeing some, but not all, customers affected. Other ESPs aren't seeing any changes. It's not just you. But it would be very worthwhile to dig into engagement and other stats. It's possible this is a new normal at Yahoo! and they're tightening filters to catch mail that doesn't fit their standards but was previously difficult to filter.No Comments

  • AOL starts using Sender Score Certification

    Good news for Sender Score Certified IPs. Return Path recently announced that AOL has joined the list of ISPs offering preferential treatment to certified IPs.  1 Comment