How to Upgrade a DKIM Key From 1024 to 2048 Bit Without Breaking Mail

To move from a 1024-bit to a 2048-bit DKIM key, publish the new key under a new selector, switch your mail provider to sign with it, wait, and only then delete the old record. Never overwrite the old key in place: mail signed with the old key and still in transit would fail verification.

Do you need to?

A 1024-bit key is valid and still accepted. It is shorter than what Google and Microsoft recommend, and longer keys are harder to attack. If your provider already generates 2048-bit keys by default, there is nothing to do. If a check shows 1024, treat it as tidy-up work, not an emergency, and do not rotate in the middle of a launch.

Rotation, step by step

1. Generate a new 2048-bit key in your mail provider's admin screen under a new selector name, for example a dated one. Keep the old selector live.
2. Publish the new record at newselector._domainkey.yourdomain and check it with a DKIM checker, entering the new selector.
3. Switch signing to the new selector in the provider, if it does not switch automatically.
4. Send a test message and confirm the header shows s= with the new selector and dkim=pass.
5. Leave the old record in place for about a week so delayed or queued mail still verifies, then delete it.

The DNS pitfall with long keys

A 2048-bit key is too long for a single 255-character DNS string. Good DNS hosts split it into several quoted strings automatically, and receivers join them. If your host rejects it, enter the value as two or more quoted strings in one TXT record. Do not break it with line breaks or spaces inside the key.

Providers that publish CNAME records for you, such as Microsoft 365, rotate on their side between two selectors. For those, follow the provider's own rotation option instead of this manual route.