0

I setup a DKIM record where I had to break up the value because it exceeded the 255 character length limitation. But now I see that online checkers are complaining about the p= not being base64 encoded. Such as this site - http://dkimcore.org/c/keycheck. Here is how I have it setup in DNS:

mta._domainkey.domain.com.      IN TXT   "v=DKIM1; k=rsa     p=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/" \ " xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxx"

In the p value, I used one of 2 formats that as I understand it, must be used when working with longer keys. So as you can see I have the slash

"xxxxxx/" \ "xxxxxx"

in there to separate the two strings. This is also the only way I could get BIND to stop complaining about the zone having syntax errors and pass its validation. I tried running it all together there without quotes and using only the slash but BIND complained. So I proceeded to use the space \ space format. Now, using the online checker, It tells me my key is "not good" and my p value is not base 64 encoded. My questions are:

1) Is the online checker complaining because it sees the record split and does not deal with that correctly or does my key actually have a problem?

2) I am wondering since it says base 64 if its not liking all of the other slashes that's in the value? Should those be in there?

3) What is best practice for working with long keys in both BIND and getting online tools to work with longer keys?

UPDATE: Here is the exact error I get on the server when I try to run the record all together without the xxxxx" \ "xxxxxxx"

dns_rdata_fromtext: db.file:70: syntax error
_default/zonename/IN: syntax error
zone zonemane/IN: loading from master file zonefile     failed: syntax error
zone zonename/IN: not loaded due to errors.
user53029
  • 619
  • 2
  • 14
  • 34
  • Can you add the real syntax? No reason to comment out the public key, it's meant to be public. I can see you wanting to comment out the domain name. – Henry Sep 10 '16 at 14:14

1 Answers1

1

The 256 length only needs to be broken down on SPF checks into multiple strings. DKIM needs to be 512 or under, This eMail Tester will validate the length of your DKIM, but I think you should put it back together. If you have a 2048 DKIM KEY, you're fine. I only seen issues with lengths using a 4096 and greater. But I also seen a lot of 4096 that will fit in the 512.

Henry
  • 910
  • 1
  • 5
  • 17
  • That's one of the problems I mentioned. When I run it all together BIND complains about a syntax error. I'll add the exact error to my question. – user53029 Sep 10 '16 at 13:23
  • @user53029 You need to break up the key in strings <= 255 bytes long. – BillThor Sep 10 '16 at 22:41