up vote 0 down vote favorite
share [g+] share [fb]

I'm trying to enter a 4028 bit DKIM key into DNS and it seems that I'm exceeding both the UDP 512 byte limit and also the maximum record size for a TXT record.

How does someone properly create a large key (with implied larger encoded size) and import it into DNS?

link|improve this question
67% accept rate
Need more detail; what is the DNS server software? – JGurtz Apr 4 '11 at 18:54
Have you carefully considered your key size? The RFC states: "Verifiers MUST be able to validate signatures with keys ranging from 512 bits to 2048 bits, and they MAY be able to validate signatures with larger keys." So your long key may not get verified. – HTTP500 Apr 4 '11 at 19:11
@JGurtz We are using "UltraDNS" it's a hosted service. – makerofthings7 Apr 4 '11 at 19:48
@Jason - We can do 2048, but I think that bit length may exceed the UDP packet limit. – makerofthings7 Apr 4 '11 at 19:48
Perhaps you should consider that the problems you create through the use of an unusually long key far outweigh the advantages you hope to gain from it. – John Gardeniers Apr 5 '11 at 0:45
show 2 more comments
feedback

2 Answers

up vote 2 down vote

You need to split them in the text field. I believe that 2048 is the practical limit for key sizes. Split the text field into parts 255 characters or less. There is overhead for each split.

There are two formats for long fields.

TXT "part one" \ "part two"

TXT ( "part one" "part two" )

Both of which will combine as "part onepart two". More details from Zytrax.

link|improve this answer
feedback
up vote 0 down vote

It's OK if the record is greater than the UDP 512-byte limit because DNS will use TCP.

This should be transparent to the user, but sometimes buggy firewall appliances (such as Cisco PIX/ASA) will filter/block these larger queries.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.