Issue Change DKIM key from 1024 to 2048

[AgustinLorenzo]

Server operating system version

Debian 12.5

Plesk version and microupdate number

18.0.58 #2

Hi guys,

I have tried to follow the guide to change the size of the DKIM key from 1024 bits to 2048 bits and it has had no effect, when I check with mail-tester.com I get the same key, and I do not see the contents of the folder " /etc/domainkeys/domain/default" has been altered

Guides: https://support.plesk.com/hc/en-us/...n-Plesk-without-causing-mail-delivery-outages and https://support.plesk.com/hc/en-us/...outgoing-emails-of-particular-domain-in-Plesk

Am I doing something wrong or is it some Plesk bug?

Regards, Agustin

 

[Peter Debik]

When you change the configuration, the change is only applied for newly generated DKIM keys.

 

[AgustinLorenzo]

Hi Peter Debik,

Thanks for approve my first post in Plesk forum

what I understand following this guide (https://support.plesk.com/hc/en-us/...n-Plesk-without-causing-mail-delivery-outages) is that the dkim keys can be changed from 1024 to 2048 for current subscriptions, apart from being the default for new subscriptions.

and when the procedure is performed:

/usr/local/psa/bin/domain_pref --update example.com -sign_outgoing_mail false
/usr/local/psa/bin/domain_pref --update example.com -sign_outgoing_mail true

The only thing that happens is that the DNS record disappears and the same record appears.

Regards, Agustin

 

[AgustinLorenzo]

Hi again,

As a solution, I don't know if it would be valid:

1º: /usr/local/psa/bin/domain_pref --update example.com -sign_outgoing_mail false
2º: delete all the contents of the "/etc/domainkeys" folder
3º: /usr/local/psa/bin/domain_pref --update example.com -sign_outgoing_mail true

and with this I think that the private key would indeed go to 2048 bits, but the public key would remain at 1024 bits, how would this public key be rotated/updated?

Regards, Agustin

 

[AgustinLorenzo]

Hi guys,

Coming back to this topic it seems that the (official) procedure changed as of version 18.0.56 and now it is:

- Change TTL to 60 seconds in DKIM entry
- Create new DKIM selector and change to this new one
- Delete old DKIM selector (default)
- Re-create DKIM selector with name "default" and change back to this selector.

There is a way to do it in a more friendly way via CLI because in servers with many subscriptions it can be very long and tedious to do, and the change to 2048 keys is almost mandatory to deal with some administrations in some countries.

Link: https://support.plesk.com/hc/en-us/...n-Plesk-without-causing-mail-delivery-outages

Best regards.