DKIM is the part of email authentication that proves a message was not altered in transit and really was signed by the domain it claims to come from. That guarantee is only as strong as the key doing the signing and the mailbox provider actually checking it. A recent test of 19 major mailbox providers by Red Sift found that both of those assumptions are shakier than most domain owners realize: fewer than half validate the modern signing algorithm that is supposed to replace RSA, and six still accept RSA keys short enough to be broken in a weekend for less than the cost of a sandwich.
The Two Numbers That Matter
Red Sift’s testing found that only 9 of 19 mailbox providers, 47 percent, correctly validate Ed25519 DKIM signatures. Ed25519 is the elliptic-curve algorithm designed to replace RSA for DKIM: the keys are smaller, verification is 10 to 20 times faster, and the cryptography carries none of RSA’s legacy weaknesses. Google has signed Gmail’s own outbound mail with Ed25519 since 2019. Despite that, Gmail, Microsoft 365, and Yahoo, the three providers that receive the largest share of the world’s email, do not validate incoming Ed25519 signatures at all. A domain that signs exclusively with Ed25519 today would have its DKIM silently fail to verify at the mailbox providers most of its mail is likely going to.
The second number is more alarming. Six of the providers Red Sift tested still accept RSA keys shorter than 1024 bits, keys the IETF formally banned from DKIM use in 2018 under RFC 8301 specifically because they are too weak to trust. HEY was found to accept both 512-bit and 768-bit signatures. LaPoste, the French postal service’s mail platform, accepted a 512-bit signature and returned a “good signature” result. Both results mean an attacker who forges a signature with a factored key can still get a pass at those providers.
Why a 512-Bit Key Is Not a Theoretical Problem
This is not a hypothetical risk. In a widely circulated 2025 experiment, researchers took a real 512-bit RSA DKIM key and fully factored it using CADO-NFS running on an 8-vCPU Hetzner cloud server. The job took roughly 86 hours and cost under $8. With the private key recovered, they forged DKIM signatures and sent test messages to a range of mailbox providers. Gmail, Outlook, Zoho, Fastmail, Proton Mail, GMX, and OnMail all correctly rejected the forged signatures because the key was too short. Yahoo Mail, Mailfence, and Tuta accepted them as valid. The same researchers scanned the top one million websites and found more than 1,700 still publishing RSA DKIM keys shorter than 1024 bits, including at least one well known domain.
Put those two studies together and the picture is consistent across a year: a meaningful slice of the mailbox provider landscape will treat a cryptographically broken signature as proof that a message is authentic, and eight dollars of cloud compute is enough to produce one.
Why This Matters Even If You Already Run 2048-Bit Keys
If your domain already signs with a 2048-bit RSA key, none of this is a direct threat to you today. The exposure runs in two other directions. First, if your DNS still has old, forgotten selectors publishing 512 or 768-bit keys from a migration years ago, those records are live and usable by anyone who finds them, regardless of what your current primary selector uses. Second, the Ed25519 support gap means that if you want the performance and cryptographic benefits of moving to Ed25519, you cannot simply cut over. Dual signing, publishing both an Ed25519 signature and an RSA 2048-bit signature on the same message, is the only approach that keeps mail authenticating cleanly at both the providers that support the new algorithm and the large majority that still do not.
What Domain Owners Should Do
Audit every DKIM selector your domain has ever published, not just the active one. Old selectors from migrated ESPs or decommissioned mail systems often stay in DNS long after they stop being used for legitimate signing, and a weak key there is just as exploitable as one in active use.
Standardize on 2048-bit RSA as the floor, not 1024. 1024-bit keys still verify at most providers but are considered weak by current cryptographic standards; there is no operational reason left to use anything under 2048 bits for a new or rotated key.
Treat Ed25519 as an addition, not a replacement, until provider support catches up. Publish it alongside RSA 2048 rather than instead of it, so mail keeps authenticating at Gmail, Microsoft 365, and Yahoo while you get the benefits where it is supported.
Rotate DKIM keys on a schedule, not just when something breaks. A key that was strong when generated does not get weaker on its own, but a rotation cadence catches forgotten selectors, limits the value of any key that does leak, and keeps your signing practice auditable.
The Takeaway
DMARC’s entire authentication model rests on SPF and DKIM actually meaning something when they pass. A DKIM pass is supposed to say a message was not tampered with and really came from the claimed domain. When six mailbox providers will validate a signature from a key that costs eight dollars to break, and the largest three providers on earth cannot yet verify the algorithm meant to fix that problem, the pass result carries less certainty than most domain owners assume. Getting your own DKIM configuration right, current key strength, clean selectors, and a sane rotation cadence, is the part of this gap that is fully within your control.
Excello Mail monitors your domain’s DKIM configuration alongside your DMARC enforcement, flagging weak keys, stale selectors, and rotation gaps before they become someone else’s opportunity. Sign up for free to Excello Mail to see the real strength of your email authentication setup today.