Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to enter a 4028 bit DKIM key into DNS and it seems that I'm exceeding both the UDP 512 byte limit and also the maximum record size for a TXT record.

How does someone properly create a large key (with implied larger encoded size) and import it into DNS?

share|improve this question
    
Need more detail; what is the DNS server software? –  JGurtz Apr 4 '11 at 18:54
    
Have you carefully considered your key size? The RFC states: "Verifiers MUST be able to validate signatures with keys ranging from 512 bits to 2048 bits, and they MAY be able to validate signatures with larger keys." So your long key may not get verified. –  HTTP500 Apr 4 '11 at 19:11
    
@JGurtz We are using "UltraDNS" it's a hosted service. –  makerofthings7 Apr 4 '11 at 19:48
    
@Jason - We can do 2048, but I think that bit length may exceed the UDP packet limit. –  makerofthings7 Apr 4 '11 at 19:48
    
Perhaps you should consider that the problems you create through the use of an unusually long key far outweigh the advantages you hope to gain from it. –  John Gardeniers Apr 5 '11 at 0:45
show 2 more comments

2 Answers

You need to split them in the text field. I believe that 2048 is the practical limit for key sizes. Split the text field into parts 255 characters or less. There is overhead for each split.

There are two formats for long fields.

TXT "part one" \ "part two"

TXT ( "part one" "part two" )

Both of which will combine as "part onepart two". More details from Zytrax.

To generate my dkim entry I insert my public key file and wrap it in quotation marks.
My public key file contains the following:

MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD78Ki2d0zmOlmjYNDC7eLG3af12KrjmPDeYRr3
q9MGquKRkRFlY+Alq4vMxnp5pZ7lDaAXXwLYjN91YY7ARbCEpqapA9Asl854BCHMA7L+nvk9kgC0
ovLlGvg+hhqIPqwLNI97VSRedE60eS+CwcShamHTMOXalq2pOUw7anuenQIDAQAB

After editing the key in my dns zone file appears as follows:

dkim3._domainkey        IN      TXT     ("v=DKIM1; t=s; p=" 
"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD78Ki2d0zmOlmjYNDC7eLG3af12KrjmPDeYRr3"
"q9MGquKRkRFlY+Alq4vMxnp5pZ7lDaAXXwLYjN91YY7ARbCEpqapA9Asl854BCHMA7L+nvk9kgC0"
"ovLlGvg+hhqIPqwLNI97VSRedE60eS+CwcShamHTMOXalq2pOUw7anuenQIDAQAB")

DNS returns it as follow:

 bill:~$ host -t TXT dkim3._domainkey.systemajik.com
 dkim3._domainkey.systemajik.com descriptive text "v=DKIM1\; t=s\; p=" "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD78Ki2d0zmOlmjYNDC7eLG3af12KrjmPDeYRr3" "q9MGquKRkRFlY+Alq4vMxnp5pZ7lDaAXXwLYjN91YY7ARbCEpqapA9Asl854BCHMA7L+nvk9kgC0" "ovLlGvg+hhqIPqwLNI97VSRedE60eS+CwcShamHTMOXalq2pOUw7anuenQIDAQAB"

DNS treats it as one long string with no extra spaces where the lines are joined. All " " sequences are ignored.

share|improve this answer
    
Can you give a example? for this I can't figure out how to make it clear what part 1 and part 2 is.... #threadnecro –  janw Jul 17 '13 at 11:28
1  
@janw I've added one of my keys as an example. This key is only 1024 bits. –  BillThor Jul 18 '13 at 0:34
    
Tnx for the quick reply. But this key fits in a 255 key. So I still don't get how you split it into multiple keys. –  janw Jul 18 '13 at 7:30
add comment

It's OK if the record is greater than the UDP 512-byte limit because DNS will use TCP.

This should be transparent to the user, but sometimes buggy firewall appliances (such as Cisco PIX/ASA) will filter/block these larger queries.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.