The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

DKIM key split over several records not working

Discussion in 'E-mail Discussions' started by rpkemp, Oct 22, 2015.

  1. rpkemp

    rpkemp Registered

    Joined:
    Apr 12, 2014
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hi. I am using Cpanel version 11.52.0.18. I want to set up DKIM for one of my domains. I'm using the Cpanel-generated key, which I have adapted (removing extraneous " and space from the middle and \; from the end) so that it is apparently acceptable (I checked it here: Check a DKIM Core Key).

    I'm using my hosting service provider's DNS servers, so I need to enter the DKIM key in their DNS management page. This won't accept the longer 2048-bit keys within a single record, so I was advised to split the key over a number of records - as I understand it these should then be concatenated into a single valid key.

    This is a screenshot of the settings in the hosting service control panel:

    - Removed -

    Unfortunately, the result doesn't seem to add up to a valid key. The response from check-auth@verifier.port25.com reads like this (I don't pretend to understand it):

    Code:
    Result:         permerror (invalid key: error reading public key: 139746777425664:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:asn1_lib.c:142:;139746777425664:error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header:tasn_dec.c:1306:;139746777425664:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:381:Type=X509_PUBKEY;)

    And this is how the receiving server (for check-auth@verifier.port25.com) sees the key (I have changed the characters & the length of the lines):


    If anyone has any idea about what I might be doing wrong I'd be grateful.
     
    #1 rpkemp, Oct 22, 2015
    Last edited by a moderator: Nov 27, 2015
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    34,936
    Likes Received:
    1,069
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    Could you report this issue to your DNS provider? The output you provided suggests the record was not properly added to the zone.

    Thank you.
     
    #2 cPanelMichael, Nov 11, 2015
  3. rpkemp

    rpkemp Registered

    Joined:
    Apr 12, 2014
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Thanks for your response, I'll do that & post back if anything emerges.
     
    #3 rpkemp, Nov 12, 2015
  4. movielad

    movielad Well-Known Member
    PartnerNOC

    Joined:
    May 14, 2003
    Messages:
    107
    Likes Received:
    2
    Trophy Points:
    18
    cPanel Access Level:
    DataCenter Provider
    I am that provider. ;)

    The biggest problem is that with every single DKIM record generated by cPanel, there appears to be an extraneous quote mark which causes a big problem for us and our customers. It'd help if we could set the size of the DKIM record so that it'll still fit within our infrastructure, but in the meantime, would you be able to provide a working example of how to split a DKIM record generated by cPanel? It seems to work for me (in that when I return to the cPanel Email Authentication section, it passes the check) but seemingly fails during external DKIM tests.

    We use TinyDNS as our nameserver of choice.

    Many thanks,

    Martyn
     
    #4 movielad, Nov 12, 2015
    orlando33 likes this.
  5. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    34,936
    Likes Received:
    1,069
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Could you verify if you still encounter the issue on cPanel version 11.52.1.0 (available on the "Current" build tier)? It includes the following resolution:

    Fixed case CPANEL-526: Updated zone parsing to support mutli-line TXT records.

    Thank you.
     
    #5 cPanelMichael, Nov 12, 2015
  6. movielad

    movielad Well-Known Member
    PartnerNOC

    Joined:
    May 14, 2003
    Messages:
    107
    Likes Received:
    2
    Trophy Points:
    18
    cPanel Access Level:
    DataCenter Provider
    Trying to split the DKIM record gave by 11.52.1.0 looks like this when queried from DNS:

    Code:
    ; QUESTION SECTION:

;default._domainkey.lizziec.net.INTXT


;; ANSWER SECTION:

default._domainkey.lizziec.net.1800 INTXT"v=DKIM1\; k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4ss6mlpr9rAXCEVT1lMIFlY2W0KjbDAJ1HU4nZKYIIujj2lTNiQYd"

default._domainkey.lizziec.net.1800 INTXT"XYW+JZ5iYscfkgh1H/gjmgdlXet3ZT2+P3dNEnel2uwJEAKeu8hfzOOQFvWH3iGWu2GkVyFC7ReYHJYDqT08Sunk3hUmhHl5l2ntsFYAqviivTgAQEJSiIms8/vblJ22l3SeRI/BKXke"

default._domainkey.lizziec.net.1800 INTXT"AX8slrgR16/Cu1uAnEUq4kD2iahrQCdRcRP6XwlbEl4BAjlxn7E11WSBZHwCx8z0pt4FuOujZJMMpc/6SudPTdJ3TK0kZCXx6qkikfa/bF+ybzC72WCb4TVQIPABg3nfroDugZI7iDgEBS"

default._domainkey.lizziec.net.1800 INTXT"GubnGUwIDAQAB\\\;"
    And when querying DKIM testers, it usually reports that it's of the wrong length, e.g.:

    Code:
    DNS record for default._domainkey.lizziec.net:

"v=DKIM1\; k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4ss6mlpr9rAXCEVT1lMIFlY2W0KjbDAJ1HU4nZKYIIujj2lTNiQYd"

We were not able to retrieve the key length, there is maybe an issue in that key
    But according to the authentication section of cPanel, DKIM is active and passes the check.
     
    #6 movielad, Nov 12, 2015
  7. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    34,936
    Likes Received:
    1,069
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Could you open a support ticket using the link in my signature so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome.

    Thank you.
     
    #7 cPanelMichael, Nov 12, 2015
  8. movielad

    movielad Well-Known Member
    PartnerNOC

    Joined:
    May 14, 2003
    Messages:
    107
    Likes Received:
    2
    Trophy Points:
    18
    cPanel Access Level:
    DataCenter Provider
    Submitting ticket now. I'm just going to post some screenshots here for reference.

    First image - this is what's presented to the user:

    2015-11-13_10-45-30.png

    We then split that over four TXT records. On the second line, we stop (and do NOT include) at the quote mark. We continue on the third line of the DKIM record. So it looks like this within our DNS manager:

    2015-11-13_10-50-12.png

    Once the DNS has reloaded, a refresh of the authentication page looks like this:

    2015-11-13_10-43-00.png

    and performing a dig on the record:

    2015-11-13_10-52-52.png
     
    #8 movielad, Nov 13, 2015
    Last edited by a moderator: Dec 18, 2015
    Infopro likes this.
  9. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    34,936
    Likes Received:
    1,069
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    To update, per the information in the support ticket, we actually split the DKIM record into 255-byte chunks by design. RFC 1035 specifies that character strings must be split up into chunks of 255 or fewer octets. The DKIM record in the zone on the cPanel server looks correct, but the records are wrapped in quotations when querying the nameservers from the entry added in TinyDNS. The advice was to consult with TinyDNS to see if there is a recommended way to address that.

    Thank you.
     
    #9 cPanelMichael, Nov 16, 2015
  10. movielad

    movielad Well-Known Member
    PartnerNOC

    Joined:
    May 14, 2003
    Messages:
    107
    Likes Received:
    2
    Trophy Points:
    18
    cPanel Access Level:
    DataCenter Provider
    Just a follow-up: Memset has now fixed our DNS manager so that you can copy and paste the record into our DNS manager and it'll be parsed properly. I've checked against an external DKIM checker and it all works. No more splitting records, etc. Takes a single line.
     
    #10 movielad, Dec 18, 2015
  11. rpkemp

    rpkemp Registered

    Joined:
    Apr 12, 2014
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Excellent, many thanks, I'll give it a try.
     
    #11 rpkemp, Dec 18, 2015
(You must log in or sign up to post here.)
Loading...
Similar Threads - DKIM split several
  1. Bananenbaas

    DKIM Invalid using Cloudflare

    Bananenbaas, May 12, 2017, in forum: E-mail Discussions
    Replies:
    2
    Views:
    79
    cPanelMichael
    May 12, 2017
  2. brandonhorn

    DKIM signature on cPanel backup notifications (2)

    brandonhorn, May 10, 2017, in forum: E-mail Discussions
    Replies:
    1
    Views:
    60
    cPanelMichael
    May 11, 2017
  3. keat63

    Is DKIM still relevent?

    keat63, Apr 25, 2017, in forum: E-mail Discussions
    Replies:
    5
    Views:
    157
    cPanelMichael
    Apr 27, 2017
  4. SToledo

    DKIM record disappear from "Email authentication"

    SToledo, Mar 23, 2017, in forum: E-mail Discussions
    Replies:
    7
    Views:
    184
    cPanelMichael
    Mar 27, 2017
  5. ItsMattSon

    SOLVED Is DKIM possible if I'm not running DNS locally?

    ItsMattSon, Mar 9, 2017, in forum: E-mail Discussions
    Replies:
    9
    Views:
    298
    cPanelMichael
    Mar 22, 2017

Share This Page