I wonder if I can simply use a 4096bit RSA key for DKIM (in DNS TXT Record).
Are there any downsides (neglecting computational effort)?
Maybe there are mail servers which can't handle a key this large?

Also: Is there any big mail provider which uses RSA keys larger than 2048bits? Google, Yahoo and Microsoft all seem to use 2048bit keys.

  • Maybe this is of help.
    – gxx
    Jan 6, 2016 at 18:51

1 Answer 1


From IETF RFC 4871 (emphasis added):

3.3.3. Key Sizes

Selecting appropriate key sizes is a trade-off between cost, performance, and risk. Since short RSA keys more easily succumb to off-line attacks, signers MUST use RSA keys of at least 1024 bits for long-lived keys. Verifiers MUST be able to validate signatures with keys ranging from 512 bits to 2048 bits, and they MAY be able to validate signatures with larger keys. Verifier policies may use the length of the signing key as one metric for determining whether a signature is acceptable.

Factors that should influence the key size choice include the following:

  • The practical constraint that large (e.g., 4096 bit) keys may not fit within a 512-byte DNS UDP response packet

  • The security constraint that keys smaller than 1024 bits are subject to off-line attacks

  • Larger keys impose higher CPU costs to verify and sign email

  • Keys can be replaced on a regular basis, thus their lifetime can be relatively short

  • The security goals of this specification are modest compared to typical goals of other systems that employ digital signatures

See [RFC3766] for further discussion on selecting key sizes.

  • 4
    Thank you. So I should not use a 4096bit key, as they are not mandatory to be supported by verifiers :) Jan 6, 2016 at 19:09
  • @FlorianSchneider Rewrote my comment, just seen your update :) Yes, exactlyt :) (& some old router can have difficulty with such long DNS packet, as the RFC state the software may accept it, but even if it's, if the router reject it, you are blocked. It's why IMO that big mail provider all use 2048 key)
    – yagmoth555
    Jan 6, 2016 at 19:14
  • How about now? 2022? Still the same, or should I use the 4096 key now?
    – Alex
    May 6, 2022 at 14:42
  • 1
    Thanks for the information. I've set the key to 4096 and sended my brother which uses hotmail a email and it arrived fine! Maybe there will be some providers who are not compatible yet, but I'm not using it for sending much email anyway, I receive more so it won't be much of a issue.
    – Alex
    May 7, 2022 at 3:24
  • 1
    Shouldn't this answer be updated with RFC 8301? "Verifiers MUST be able to validate signatures with keys ranging from 1024 bits to 4096 bits" datatracker.ietf.org/doc/html/rfc8301 Aug 5, 2023 at 9:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .