How should DKIM selector names be interpreted and what is the recommended DKIM key size?

Summary

DKIM selector names are often interpreted based on their naming convention, frequently including the key's generation date or purpose, but this is not strictly required. Selectors facilitate key rotation and management by allowing senders to publish multiple public keys. The recommended DKIM key size is generally 2048 bits or greater for enhanced security. While 1024-bit keys are supported by RFC 8301, they are less secure. Regular key rotation (e.g., every 2-5 years) using new selectors improves security, though testing for compatibility with older systems supporting smaller key sizes is essential.

Key findings

  • Selector Interpretation: DKIM selector names may indicate key generation date or purpose, but the selector itself is arbitrary.
  • Key Size Recommendation: 2048 bits or greater is the recommended DKIM key size for strong security, with 4096 being a future goal.
  • Key Rotation: Regular DKIM key rotation is crucial for security and can be facilitated by selectors.

Key considerations

  • Compatibility: Test compatibility, especially with older systems that may have issues with key sizes larger than 1024 bits.
  • Security vs. Performance: Consider the trade-offs between security and performance implications of larger key sizes.
  • Naming Conventions: Descriptive selector names can aid key management and troubleshooting but are not mandatory.

What email marketers say
11Marketer opinions

DKIM selector names can be interpreted based on the naming convention used, often including the key's generation date or purpose. While there's no strict standard, descriptive names aid key management. The recommended DKIM key size is generally 2048 bits or greater for enhanced security. While some older systems might support 1024-bit keys, a move to 2048 bits is strongly advised for improved protection against spoofing.

Key opinions

  • Selector Interpretation: DKIM selector names often indicate the key's generation date or purpose, assisting in key management.
  • Recommended Key Size: The recommended DKIM key size is 2048 bits or greater for enhanced security.
  • Security: Larger key sizes offer improved protection against spoofing and unauthorized email.

Key considerations

  • Compatibility: Older systems might have issues with keys larger than 1024 bits, so testing is essential.
  • Key Naming: Descriptive selector names can aid key management and troubleshooting.
  • Key Rotation: DKIM selectors can be used to facilitate key rotation and management.
Marketer view

Email marketer from MXToolbox suggests that DKIM selectors should be short, alphanumeric strings. They also mention that selectors should be unique to prevent conflicts when using multiple DKIM keys.

January 2022 - MXToolbox
Marketer view

Email marketer from Reddit (u/EmailExpert) shares that while 2048-bit keys are generally recommended, some older systems might have issues with keys larger than 1024 bits. It's essential to test compatibility.

December 2024 - Reddit
Marketer view

Email marketer from mailhardener.com specifies that the recommended DKIM key size as of today, should be 2048-bit. If for some reason you can't, then 1024 bits is acceptable, however, anything below that is unsafe and should be avoided.

February 2025 - mailhardener.com
Marketer view

Marketer from Email Geeks answers that if a DKIM selector is "201802", it would be interpreted as the key not being rotated since 2018.

August 2023 - Email Geeks
Marketer view

Email marketer from StackOverflow (TechGuru) explains that DKIM selectors can be named using a convention that includes the year and quarter in which the key was generated to help with tracking and rotation, but it's not a strict requirement.

May 2023 - StackOverflow
Marketer view

Email marketer from SendGrid shares that while 1024 bit keys are supported, 2048 bit keys should be implemented because they offer significantly more protection against spoofing and are less likely to be compromised.

October 2021 - SendGrid
Marketer view

Marketer from Email Geeks remembers doing a project to move to 2048-bit keys in 2017-2018 and believes the RFC allowing 4096-bit keys was released in 2018.

October 2024 - Email Geeks
Marketer view

Email marketer from SparkPost suggests that DKIM selectors should be descriptive and indicate the purpose or generation date of the key. This helps with key management and troubleshooting.

April 2024 - SparkPost
Marketer view

Marketer from Email Geeks says that a minimum DKIM key size now is 2048, 4096 should be a goal.

October 2022 - Email Geeks
Marketer view

Email marketer from easydmarc.com mentions the standard DKIM key size is 2048-bit as a minimum. It protects against vulnerabilities and provides the best level of security.

June 2021 - easydmarc.com
Marketer view

Email marketer from dmarc.org recommends using a key length of 2048 bits or greater to ensure adequate security and compatibility with modern email systems.

November 2024 - dmarc.org

What the experts say
2Expert opinions

DKIM selectors are arbitrary identifiers used to publish multiple public keys, facilitating key rotation. Experts recommend key sizes of 2048 bits and regular rotation, suggesting rotation every 2-5 years.

Key opinions

  • Selector Purpose: DKIM selectors are arbitrary identifiers for publishing multiple public keys.
  • Key Size Recommendation: 2048-bit keys are recommended by experts.
  • Key Rotation: Regular key rotation is advised, with a suggested interval of 2-5 years.

Key considerations

  • RFC Syntax: Consult the relevant RFC for more specific information on DKIM selector syntax.
  • Regular Key Rotation: Consider regularly rotating DKIM keys to mitigate security risks.
Expert view

Expert from Spamresource mentions that the selector is arbitrary and is used to publish multiple public keys. They also suggest to check the RFC for more specific information on syntax.

June 2023 - Spamresource
Expert view

Expert from Email Geeks bumped his keys to 2048 and rotates them after 2-5 years.

March 2023 - Email Geeks

What the documentation says
4Technical articles

DKIM selectors are strings identifying DKIM key pairs, enabling receivers to locate the public key for verification. They facilitate key rotation and management, allowing senders to publish multiple keys. RSA keys should be at least 1024 bits, ideally 2048 bits or longer, for better security. Regular key rotation with new selectors enhances security by minimizing the impact of compromised keys.

Key findings

  • Selector Identification: DKIM selectors identify the key pair used to sign an email, helping receivers find the public key.
  • Key Rotation Support: Selectors enable key rotation and management by allowing multiple published keys.
  • Minimum Key Length: RSA keys should be at least 1024 bits, with 2048 bits or more recommended.

Key considerations

  • Regular Rotation: Regularly rotate DKIM keys for enhanced security.
  • Selector Uniqueness: Use a new selector for each key rotation to limit the impact of compromised keys.
  • Performance: Key size impacts both security and performance; consider the trade-offs.
Technical article

Documentation from Google Workspace Admin Help recommends regularly rotating DKIM keys. Using a new selector for each key rotation improves security by limiting the impact of a compromised key.

November 2023 - support.google.com
Technical article

Documentation from Cloudflare.com states that a DKIM selector is a string that identifies the DKIM key pair used to sign an email. It tells the receiving server where to look up the public key to verify the signature.

February 2022 - Cloudflare.com
Technical article

Documentation from Valimail.com explains that DKIM selectors are used to facilitate key rotation and management. Selectors allow senders to publish multiple DKIM keys and receivers to determine which key to use for verification.

September 2022 - Valimail.com
Technical article

Documentation from datatracker.ietf.org (RFC 8301) specifies that RSA keys used for DKIM signatures MUST be at least 1024 bits long and SHOULD be 2048 bits or longer. It also discusses the implications of key size on security and performance.

November 2022 - datatracker.ietf.org