DKIM signature types (algorithms) that we see (as of July 2022)


![]()
A lot of email these days is signed with DKIM, partly because signing email with DKIM is increasingly mandatory in practice. But 'signed with DKIM' is a broad category because DKIM has more than one signing algorithm and on top of that is used with (public) keys of different lengths.
What signing algorithms DKIM supports in practice is a matter for some discussion. The initial DKIM RFCs, such as RFC 6376, support rsa-sha1 and rsa-sha256. RFC 8301 deprecates rsa-sha1 and says that it shouldn't be used (and that a message with only a rsa-sha1 DKIM signature should be considered to fail validation). RFC 8301 also says RSA keys must be at least 1024 bits long and should be at least 2048 bits; again, messages with too-small keys should be considered to fail validation. RFC 8463 defines Ed25519 based DKIM keys, but apparently very few big providers actually support them, which makes them relatively pointless and useless in practice. Probably the most broadly useful algorithm and key length is rsa-sha256 with 2048 bit keys.
-
- Login or register to post comments
Printer-friendly version- 856 reads
PDF version
More in Tux Machines
- Highlights
- Front Page
- Latest Headlines
- Archive
- Recent comments
- All-Time Popular Stories
- Hot Topics
- New Members
today's howtos
| Open Hardware: XON/XOFF and Raspberry Pi Pico
|
Security Leftovers
| How to Apply Accent Colour in Ubuntu Desktop
A step-by-step tutorial on how to apply accent colour in Ubuntu desktop (GNOME) with tips for Kubuntu and others.
|



This section of TuxMachines will no longer have new stories in it (with some caveats, including this post). To see the latest stories go to

.svg_.png)
Content (where original) is available under CC-BY-SA, copyrighted by original author/s.


Recent comments
2 days 2 hours ago
2 days 6 hours ago
2 days 6 hours ago
3 days 13 hours ago
3 days 14 hours ago
3 days 15 hours ago
3 days 15 hours ago
3 days 16 hours ago
3 days 18 hours ago
3 days 20 hours ago