Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

DKIM Key Length

Discussion in 'Bind/DNS/Nameserver' started by sadwargamer, Jul 21, 2015.

Thread Status:
Not open for further replies.
  1. sadwargamer

    sadwargamer Registered

    Joined:
    Jul 5, 2008
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    51
    Hi,

    The DKIM key created is too long for the TXT entry field (limit 255 characters) - I understand that the latest version of cpanel uses 2048 key whereas a 1024 key from previous versions genertaed a key of 255 charcters or less.

    As I cannot add a long TXT record can someone let me know who I can force WHM/Cpanel to use 1024 key size so I can create correct TXT entries.

    Regards
    Andy
     
    #1 sadwargamer, Jul 21, 2015
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello :)

    Could you verify which version of cPanel is installed on your system? This should be addressed in cPanel version 11.50.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 cPanelMichael, Aug 6, 2015
  3. sadwargamer

    sadwargamer Registered

    Joined:
    Jul 5, 2008
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    51
    Hi,

    Yes I am on 11.50 but all new domains are created with the 2048 key - how can I change this to the 1024 key please.

    thanks.

    regards
    andy
     
    #3 sadwargamer, Aug 6, 2015
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Could you verify why you can't add the long TXT record? For instance, do you mean you are adding it somewhere other than cPanel where the DNS is hosted? It should not be an issue adding it through cPanel.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 cPanelMichael, Aug 6, 2015
  5. sadwargamer

    sadwargamer Registered

    Joined:
    Jul 5, 2008
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    51
    I need to add the DKIM as a TX record with my DNS provider and they do not support (currently) more than 255 characters otherwise of course I woudl use 2048...

    I cannot be the only one in the world in this position :(
     
    #5 sadwargamer, Aug 6, 2015
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello:)

    Internal case CPANEL-794 is open to address the improper handling of quotes and data length for TXT records (DKIM). You can monitor our change logs to see when this case has been resolved:

    cPanel - Change Logs

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #6 cPanelMichael, Aug 25, 2015
  7. Pablo1981

    Pablo1981 Registered

    Joined:
    Oct 2, 2015
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Bucaramanga, Colombia
    cPanel Access Level:
    Root Administrator
    Has this been fixed yet?
    I did not find the case in the logs!
    This is urgent since it affects email!
    Thanks
     
    #7 Pablo1981, Oct 2, 2015
  8. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Internal case CPANEL-794 has not yet been released, but I do see activity on this case as recent as a few days ago. There's currently no exact time frame I can provide on when a resolution will be implemented, but please feel free to monitor our change log for the case number.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #8 cPanelMichael, Oct 5, 2015
  9. dazeck

    dazeck Well-Known Member

    Joined:
    Jul 19, 2014
    Messages:
    58
    Likes Received:
    11
    Trophy Points:
    8
    Location:
    England
    cPanel Access Level:
    Root Administrator
    Sorry to bump this thread, but I am having an issue with DKIM and I think it's due to this case number 794. Are we any closer to getting this resolved ? If not, how can we manually generate dkim and get email signing working. My old keys all work fine, but keys generated recently are failing and its for a new customer.

    I get this when testing with verifier.port25.com

    DKIM check details:
    ----------------------------------------------------------
    Result: fail (signature doesn't verify)
     
    #9 dazeck, Nov 3, 2015
  10. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Could you verify if you have checked any alternate testing websites? You can also verify if the record appears with a command such as:

    Code:
    dig txt default._domainkey.domain.com @ns1.nameserver.com
    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #10 cPanelMichael, Nov 4, 2015
  11. dazeck

    dazeck Well-Known Member

    Joined:
    Jul 19, 2014
    Messages:
    58
    Likes Received:
    11
    Trophy Points:
    8
    Location:
    England
    cPanel Access Level:
    Root Administrator
    This appears to have rectified itself once I had logged a support ticket, typical. To get around this whilst waiting for the support team (the time difference doesn't help), I had to manually generate the keys. The following day, when disabled and re-enabled the DKIM setting against the account and checked using verifier.port25.com it verified ok. I have no idea why it wouldn't work one day then started to work the next.
     
    #11 dazeck, Nov 5, 2015
  12. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    I am happy to see the issue is now resolved. In general, it's a good idea to check via the "dig" command because third-party websites may use cached or incorrect methods of verifying the record.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #12 cPanelMichael, Nov 5, 2015
  13. JamasWise

    JamasWise Member

    Joined:
    Jun 18, 2014
    Messages:
    11
    Likes Received:
    1
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    If you are using Cloudflare, I finally found a work around. This might work for other DNS systems.

    When cpanel displays the new longer keys on the email authentication screen it does so in the format that DNS system would do to maintain the 255 character limit of the TXT field. It does this by adding a quote " and space before the next part of the key. If you are pasting this into Cloudflare then strip out all the quotes and the space. Cloudflare when serving the record will split it. But if you paste it in split then it won't resolve correctly.

    Hope this helps others.
     
    #13 JamasWise, Nov 5, 2015
    JamesGG likes this.
  14. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Thank you for taking the time to provide a workaround for CloudFlare. I'm happy to see that addresses the issue.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #14 cPanelMichael, Nov 6, 2015
  15. doekia

    doekia Registered

    Joined:
    Dec 20, 2015
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    my place
    cPanel Access Level:
    Website Owner
    humm, I feel really confused.

    RFC-4408 - 3.1.3
    RFC-1035 - 3.3
    RFC-1035 - 3.3.14
    RFC-1035 - 5.1
    1/ I see no limit to 255 expressed "MUST" as part of the RFCs.
    2/ Assuming there is one, it is 255, but cpanel build the strings as follow:
    Code:
    "v=DKIM1\; k=rsa\; p=first" "second\;"
    With "v=DKIM1\; k=rsa\; p=first" been 260 characters.
    Trail the quotes, count is 258 characters still.
    Trail the back-quote (wonder why btw), count is 256 characters still.
    ALL those characters count exceed 255 if it is a limit ?!?.
     
    #15 doekia, Dec 20, 2015
  16. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Could you verify if you are using a third-party DNS provider to add the DKIM records, and if so, the name of that provider?

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #16 cPanelMichael, Feb 2, 2016
  17. havok89

    havok89 Registered

    Joined:
    Mar 22, 2016
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Glasgow
    cPanel Access Level:
    Root Administrator
    Has this been addressed yet?

    I need to change the key length so that it fits with the limit on my DNS provider (fasthosts).

    Just now the key is too long and like mentioned above it is broken with the quotation marks. the bit inside the quotation marks is 255 in length and would fit but I can't create the record with the second part after the split.

    I can't find anything about how to change the key length, is it possible in cPanel, WHM or via SSH?
     
    #17 havok89, Mar 22, 2016
  18. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    We are considering options on how to best handle remote DNS providers that are not accepting the correct DKIM format (We provide a format that meets RFC standards). It's discussed on this thread:

    How to Enter DKIM record into DNS Zone

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #18 cPanelMichael, Mar 23, 2016
    Solokron likes this.
Loading...
Similar Threads - DKIM Length
  1. lfpiaggio

    DKIM: encountered the following problem validating domain : bodyhash_mismatch

    lfpiaggio, Jul 20, 2018, in forum: E-mail Discussion
    Replies:
    8
    Views:
    300
    cPanelLauren
    Aug 9, 2018
  2. ELSSys

    DKIM records when clustered servers use MyDNS

    ELSSys, Jun 18, 2018, in forum: Bind/DNS/Nameserver
    Replies:
    1
    Views:
    101
    cPanelMichael
    Jun 19, 2018
  3. Luciano Donato

    DKIM: encountered the following problem validating

    Luciano Donato, Jun 12, 2018, in forum: Discussões em Português
    Replies:
    13
    Views:
    346
    lfpiaggio
    Jul 20, 2018
  4. Yasser Masood

    DKIM for main server hostname II

    Yasser Masood, Jun 7, 2018, in forum: E-mail Discussion
    Replies:
    1
    Views:
    158
    cPanelMichael
    Jun 7, 2018
  5. meeven

    SOLVED Error in DKIM core record

    meeven, Jun 2, 2018, in forum: E-mail Discussion
    Replies:
    8
    Views:
    278
    jcalvert
    Jun 30, 2018
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice