2
DKIM 4096 Bit key
Problem reported by Sebastian Linge - 5/21/2024 at 12:51 PM
Submitted
Hello, there are right now existing 1 Bug.

If I create a 4096 Bit key and add him to DNS and submit a mail to  a public governemnt organisation of germany  I get error: Remote Server returned: '550 #5.7.5 DKIM unauthenticated mail is prohibited'
If I create a 2048 Bit key and add him to DNS and submit the same mail again I get a success message that they receive the mail. It seems there is some issue on 4096 Bit Keys. 

Hope you can solve that issue. It not possible to use 4096 at the moment.

Best,
Sebastian

7 Replies

Reply to Thread
0
Patrick Jeski Replied
I just created 4096 bit DKIM on a new domain on build 8902 beta for Linux, and converted an existing domain's DKIM to 4096 bit on build 8092 stable for windows, and had no issues. They pass dmarcian's tests with flying colors and gmail accepts email from them.
0
Kyle Kerst Replied
Employee Post
It is possible the receiving host is querying a DNS environment that can't handle larger DNS keys. I know in the past we had to advise administrators to "split" the 2048+ bit DKIM keys when entering them into Windows DNS in particular because it was unable to handle the larger key sizes. That process is described here in case you're curious: 

Kyle Kerst IT Coordinator SmarterTools Inc. www.smartertools.com
0
Brian Bjerring-Jensen Replied
There is a difference when you chose the 4096 key and copy it

v=DKIM1; k=rsa; h=sha256; p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA44AeunIH/kuQSNHVXvqGEeBa8sVAqW42QUtlSA4L77q/ubyyUrwltA2/iGMO4KqtB6TU7PtzoiOoK0hvmHUaDweJn/dKT3YJCD10nUdeIT3vW/ZZd9RERKKjo2iVqoOsUkE3C3PVqjVedXKU/SekLTLwejHL5wBOPJ+IX3LDiCgGShzdma8j+qdNVYTmp4in/w5J6FW/G5HS+1nx8uEPXGr7xxzYMCVza9KneAnEA5HgZ0S+l5nAA0eHodKohIvt42Q8+/wJquIoSMXmoHs+PnvhmrtN8N/IERnDkqfwS6RQmKhJQGDSmcnnQMVCYVK6VBVcCJfet9Bi/yrqbHAgm/DBkTSUMbJDvlpLCY0JNSkSZt4ITmERA0qt7PivPg1QiuGGaSXd5QtRPKGZAl0gnxRJ5p2E2YtBQAsc61EN+XrujrFthMz+BUh9ok37TTZ70TzZ6st95BLXKXLn+JGhbzMmnbr2fJEOBTSfqt5y4DnWQ/7V76i5dqo6jB/M1w7Jrnr2G5Xin9h7sId1hkNUUbTo1CYwVG8ajIafCLwgik3DrqnIK1WbFaTbGF89OkDG4XOPPqLkXCnAalTU0b2Xb2gGeK16aZaDJQwDKLO4KoKf/ZzKtyNWPqkoMlBt7a9iDcw3FR22rcCIX0L99Ue1G8lykAX3KHiy8cM9FaGyi2cCAwEAAQ==

v=DKIM1; k=rsa; h=sha256; p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA44AeunIH/kuQSNHVXvqGEeBa8sVAqW42QUtlSA4L77q/ubyyUrwltA2/iGMO4KqtB6TU7PtzoiOoK0hvmHUaDweJn/dKT3YJCD10nUdeIT3vW/ZZd9RERKKjo2iVqoOsUkE3C3PVqjVedXKU/SekLTLwejHL5wBOPJ+IX3LDiCgGShzdma8j+qdNVYTmp4in/w5J6FW/G5HS+1nx8uEPXGr7xxzYMCVza9KneAnEA5HgZ0S+l5nAA0eHodKohIvt42Q8+/wJquIoSMXmoHs+PnvhmrtN8N/IERnDkqfwS6RQmKhJQGDSmcnnQMVCYVK6VBVcCJfet9Bi/yrqbHAgm/DBkTSUMbJDvlpLCY0JNSkSZt4ITmERA0qt7PivPg1QiuGGaSXd5QtRPKGZAl0gnxRJ5p2E2YtBQAsc61EN+XrujrFthMz+BUh9

Number 2 is what actually appears at the DNS control panel when using the copy button. Significantly shorter....highlighted letters are missing.

And thats why it doesnt work. 2048 bit key is accepted immediately.
0
Patrick Jeski Replied
Brian, I’ll double check that, but clicking the copy button is what I did and dmarcian identified it as a 4096 bit key and passed it. 

I just checked one of the two domains I set up. Selecting the whole key and copying and using the button both copy the whole key, not truncated. I’m thinking maybe the dns panel is limiting the paste?
0
Sebastian Linge Replied
Hi. I was do our test with a message to some German government. They reject our mail with 4096 bit size who I create in smarter mail. If I use some account from Liveconfig hosting panel and 4096 it is arrive at that government. Tony from smartermail was see that error as well once he send to that government mail address. So if another mail solution with 4096 are working and smarter mail not it mean there is an issue on smarter mail and the key mechanism. 2048 are working correct. Mails with 4096 who will send to Gmail or some also work. But to government not .
0
Zach Sylvester Replied
Employee Post
Hey Sebastian, 

If you're using Windows DNS you need to add line breaks to get around the character limit. Here's an example of how to achieve that here. https://www.xeams.com/ms-dns.htm
But, not sure what DNS you're using but just a shot in the dark. 😊

Thanks, 
Zach Sylvester Software Developer SmarterTools Inc. www.smartertools.com
1
Sebastian Linge Replied
Hello, our dns based on linux. we are a member of domain-bestellsystem.de . Our DNS are 100% right setup. As I told you before on LIVECONFIG it is working with 4096 Key Size and with SMARTERMAIL it is not working with 4096 Key Size.

Reply to Thread