Cryptographic Algorithm and Key Usage Update to DomainKeys Identified Mail (DKIM)
updates
- rfc-6376 — DomainKeys Identified Mail (DKIM) Signatures
Extracted elements (10)
SHA-1 is prohibited proactively to allow the operational community time to fully shift to SHA-256 in advance of any SHA-1-related crisis, given its recognized weakness and the wide availability of SHA-256.
Widely used DNS configuration software places a practical limit on key sizes because it only handles a single 256-octet string in a TXT record, making RSA keys significantly longer than 1024 bits impractical in many deployments.
DKIM signatures identified as having been signed with historic algorithms (rsa-sha1) or with insufficient key sizes (rsa-sha256 with less than 1024 bits) have permanently failed evaluation per Section 3.9 of RFC 6376.
Signers MUST sign using rsa-sha256. Verifiers MUST be able to verify using rsa-sha256. rsa-sha1 MUST NOT be used for signing or verifying.
Signers MUST use RSA keys of at least 1024 bits for all keys. Signers SHOULD use RSA keys of at least 2048 bits.
Verifiers MUST be able to validate signatures with keys ranging from 1024 bits to 4096 bits, and they MAY be able to validate signatures with larger keys.
Verifiers MUST NOT consider signatures using RSA keys of less than 1024 bits as valid signatures.
DKIM supports two signing algorithms: rsa-sha1 and rsa-sha256. rsa-sha1 is now historic and permanently fails evaluation; rsa-sha256 is the required algorithm.
IANA updated the 'sha1' registration in the 'DKIM Hash Algorithms' registry, changing its status to 'historic' and adding RFC 8301 as a reference.
This document reduces the risk of signature compromise due to weak cryptography. The SHA-1 risks discussed in RFC 6194 are resolved by rsa-sha1 no longer being used by DKIM.