Email Deliverability PSA: 1024-bit DKIM keys are being flagged by major inboxes

The Shift from 1024-bit to 2048-bit DKIM

For over a decade, 1024-bit RSA signatures were considered adequate for DomainKeys Identified Mail (DKIM). However, recent cloud compute factorization breakthroughs have reduced the margin of safety for 1024-bit keys.

Starting in mid-2026, Gmail and Yahoo Mail began penalizing domains using 1024-bit keys with reduced spam filter tolerance scores. If your domain does not sign with at least 2048-bit RSA or Ed25519, your inbox placement is at immediate risk.

Verifying Your Current DKIM Record

You can verify your current public key size using dig or your DNS management terminal. Notice the key size difference in the DNS response:

# Query your domain's selector TXT record
dig +short TXT k1._domainkey.yourdomain.com

# Expected 2048-bit output format:
"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx4n..."

How Kosh Automates 2048-bit Key Rotation

Manually rotating DKIM keys is notoriously risky—a single typo in a base64 string drops all incoming outbound deliverability instantly. Kosh solves this at the protocol level.

When you connect your domain to Kosh, we automatically generate 2048-bit cryptographic key pairs and dual-publish selectors. This ensures zero delivery disruption during scheduled key rotation cycles.

• Pre-configured 2048-bit RSA keys with instant DNS propagation validation
• Automated bi-annual key rotation without touching your nameservers
• Alignment verification with SPF and DMARC enforcement policies (p=reject)