Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am setting up a mail system based on exim4. This system implements DKIM signing and checking (among other things). Signing seems to work without problems but checking doesn't work and exim4 complains about the syntax of my TXT records which carries my dkim public key:

2014-02-02 22:37:31 1WA5fP-0004Y4-E2 DKIM: s=a9d04665528b593d263a6e5256648c99 c=relaxed/relaxed a=rsa-sha256 [invalid - syntax error in public key record]

I am using a 2048 bits long RSA key to sign my mails at the mail relay level (this works ok and I indeed have DKIM headers in the mails relayed through this server). The proble mseems to be in the fact that bind (my DNS server for that zone), doesn't support records that are more than 255 characters long in the zone file. So I have chosen to split the record as shown bellow, and as described in the very trustworthy website

a9d04665528b593d263a6e5256648c99._domainkey IN  1800 TXT    ("k=rsa,p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz2/ZfhxSI/A"

Complete zine file can be found here:

With that configuration exim complains about the error above. If I try to manually resolve my dkim records here is what i get:

;; ANSWER SECTION: 1800 IN TXT "k=rsa,p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz2/ZfhxSI/A" "bqgh0amM8ylrlosirWeKShUhq7fg12aYmRwOqq9hIzO0Fcz1BzfgHVu6HU++rC5" "QoUK0JQK/nk4jwkDgvG2di2ZYmAvEbY/VeiK1x/TG0p1Iczr2k6Bj0gEAb/YGD2" "YbwrwAi4bDXwoPsYuuNn9TB3jjyWKu/dvOsqhff1/4Wc+FkOi0ClvgrXiklN28X" "TLjyjSyU794ntIoegXxrfwcwkhfPMvuqcnhfIC0Z8L71M4WR4SoHyNHVfBtNlUv" "VNROiXlMxtxnNQvfViSwz6LC8bYIxeAba3hSXPTChKu3qZtfR0o3jFwEWAfLQdg" "Ixler0jMEoAyJmfQIDAQAB"

That doesn't look quite right to me and I can imagine that exim gets lost with such an output. However I am not 100% sure whether it's a normal dns reply for such a long dns record and exim should handle it, or if it's the way I sat up bind that is wrong.

Any help on this would be appreciated.


share|improve this question
up vote 2 down vote accepted

You are using commas to separate your key/value pairs in your record instead of semi-colons. Change it to:

a9d04665528b593d263a6e5256648c99._domainkey IN  1800 TXT (

Also, I'll note that in my particular zone file, I specifically declare the version as v=DKIM1 and I think you should too. On a side note, I do not wrap the record with ( ) because I just do it all as one long line:

record._domainkey IN 1800 TXT "v=DKIM1;blah" "blah2" "blah3"

It's a personal preference, and I realize now that yours is certainly much more readable.

share|improve this answer
I am not sure how I missed that but that did the trick (even without version, but I added it as wel)l) – alxgomz Feb 3 '14 at 19:08
I have bind9 and I noticed I cannot put more than 255 characters in a single string. But splitting it into multiple strings (on the same line) like in your example, each less than 256 characters long, then it works. – Jonas Berlin Jul 14 at 8:51
Seems it is specified in RFC1035 section 3.3: "<character-string> is a single length octet followed by that number of characters. <character-string> is treated as binary information, and can be up to 256 characters in length (including the length octet)." – Jonas Berlin Jul 14 at 8:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.