DIAGNOSTIC PLAYBOOK
A DKIM key is too weak: plan a supported replacement
A published DKIM key can be syntactically valid yet fail modern cryptographic requirements. Review the algorithm and key size rather than assuming that any nonempty public-key value is sufficient.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Identify the signature algorithm and the public key's type and size with an appropriate validator.
- Compare the result with current DKIM standards and your provider's supported key options.
- Generate or request a supported replacement, publish it under a new selector and verify before retiring the old key.
What this looks like
ILLUSTRATIVE EXAMPLE
A legacy server still signs using an obsolete algorithm while its DNS record resolves normally. DNS availability does not make that signature acceptable.
A mistake to avoid
For hosted email, obtain the replacement through the provider. Never upload or publish a private signing key in DNS.
Keep the result in context
A DKIM investigation needs a real signed message and the public key for its selector and signing domain. DNS alone cannot prove that a service is signing outgoing mail. Preserve the raw source when comparing messages so your own copy process does not change the bytes being checked.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.