DNS: Investigate supporting 2048-bit DKIM keys

[arinoch]

What

I would like the ability to allow for TXT records longer than 255 characters, which would enable support for a more secure 2048-bit DKIM key.

Why

1024-bit security keys, which are the longest security keys that will fit in a 255-character TXT record, have been discouraged since 2014 for SSL certificates, as well as more generally by the NIST. Some email providers, such as the one used by our user in 6685037-zd-a8c, are refusing to be backwards compatible for security reasons. Allowing for a longer TXT record, therefore, will by default make our users' DKIM keys more secure.

How

Google suggests one way and provides examples, which is to split a longer key into 255-character chunks (each individually quoted). If extending the length of this record type is not possible, can we support splitting records as described in the Google example?

[github-actions]

Support References

This comment is automatically generated. Please do not edit it.

• 6685037-zen
• 6711206-zen
• 7131931-zen
• 7227680-zen
• 7235803-zen

[cuemarie]

📌 ACTIONS

• Feature request kept

[DavidSaladu]

This customer insisted on it as well 6711206-zd-a8c

[cuemarie]

FYI @Automattic/nomado - would y'all know if is this on the horizon for domains?

[delputnam]

This is a limitation of our current version of PowerDNS. Systems is working to migrate to the new version. Once that cutover is complete, we can remove the 255 character limit on TXT rdata.

Splitting records into multiple "chunks" won't work on this version of PDNS either.

(This cutover is also related to DNSSEC support.)

[jamiepalatnik]

Another request in this chat: 7131931-zd-a8c

[delputnam]

Still awaiting the PDNS migration.

[i11za]

Another request in this chat: 7227680-zd-a8c

[filipanoscampos]

Another one 7235803-zd-a8c

[nightnei]

@delputnam I remember we removed 255 limitation on Tumblr. So I wanted to ask - does it mean that we can do the same for wp.com? If so, and if you have bandwidth - add it please to your board or if you don't have bandwidth - I can do it.

[delputnam]

@nightnei This restriction has already been removed on WPCOM. Sorry that we never updated this issue. I'll go ahead and mark it closed.