# Do I need 2048-bit DKIM?

**NO**—1024 is fine

> Bigger keys sound safer, but 1024-bit DKIM is RFC-compliant, accepted by every major mailbox provider, and satisfies every bulk-sender requirement. 2048 buys you DNS headaches, not deliverability.

Security instinct says a bigger key must be better. For DKIM on transactional and marketing mail, the practical answer is that 1024-bit keys are the right choice—and no inbox provider rewards you for going larger.

## 1024-bit is compliant and universally accepted

[RFC 8301 §3.2](https://datatracker.ietf.org/doc/html/rfc8301#section-3.2) establishes 1024 bits as the minimum length verifiers must support and recommends signers use at least that. Gmail, Outlook, Yahoo, and Apple all accept 1024-bit signatures, and 1024-bit keys remain widely used across the industry. This is why Resend signs outbound mail with 1024-bit keys.

## The bulk sender rules don't care about key length

The bulk sender requirements from Google, Yahoo, and Microsoft—the ones that apply once you send 5,000+ messages a day—require DKIM alongside SPF and DMARC. **None of them mandate a key length.** A 1024-bit signature satisfies them completely.

## What 2048 actually costs you

- **Latency at scale.** Larger keys take longer to sign and verify on every single message.
- **DNS friction.** The longer public key doesn't fit comfortably in a TXT record. Some DNS providers hit character limits or force you to split the value across strings—a classic source of broken DKIM records and failed verification.
- **Zero placement upside.** Mailbox providers do not give 2048-bit signatures better treatment. A valid 1024-bit signature and a valid 2048-bit signature are, to the inbox, the same thing: valid.

## The exception

If your security or compliance team has a hard policy requiring 2048-bit keys, that's a policy decision—a legitimate one—but it's not a deliverability decision. Make it with eyes open about the DNS setup it demands, and test the record carefully once it's live.

---

- Canonical: https://doineed.email/2048-bit-dkim
- Learn more: https://resend.com/docs/knowledge-base/do-i-need-2048-dkim
- All questions: https://doineed.email/llms.txt

An opinionated answer from the [Resend](https://resend.com) team.