Update DKIM to rsa-sha256

Why does Gmail require rsa-sha256 for DKIM?

You sent a batch of transactional emails yesterday. Today, some are in the spam folder or not delivered at all. You check your logs — the bounce reason says "DKIM signature verification failed." You didn't change anything. But Gmail now demands more from your DKIM signatures than it did last year.

Gmail’s shift to require rsa-sha256 isn’t random. It’s a response to long-known cryptographic vulnerabilities in rsa-sha1. Using outdated algorithms doesn't just make your email less secure — it harms your sender reputation and increases delivery risk. Upgrading your DKIM to use rsa-sha256 isn’t optional anymore if you want reliable inbox placement with Gmail. This change aligns with IETF standards and reflects a broader industry move toward stronger authentication.

Key takeaways

Gmail no longer accepts messages with DKIM signatures using the outdated rsa-sha1 algorithm due to known cryptographic weaknesses.
Messages signed with rsa-sha1 may be blocked, marked as low-reputation, or fail deliverability tests, especially with Gmail and other major email providers.
Switching to rsa-sha256 ensures compliance with current IETF standards and supports long-term email deliverability across modern email platforms.

How to update DKIM to rsa-sha256 from rsa-sha1 for Gmail compliance

Update your DKIM record by generating a new key pair using rsa-sha256, replacing your existing rsa-sha1 signature in the DNS TXT record, and publishing the updated record. This change ensures your emails pass Gmail’s stricter alignment checks, improves sender reputation, and prevents delivery issues. Use tools like MxToolbox or Google’s own email validation services to confirm the update.

Step-by-step: Update DKIM algorithm to rsa-sha256

Access your DNS dashboard through your email provider or hosting platform—like SendGrid, AWS SES, or a domain registrar such as Cloudflare or GoDaddy. You need admin-level access to modify DNS records.
Locate your existing DKIM TXT record—it typically starts with a selector (like default._domainkey) and contains a rsa-sha1 algorithm. Check the full record value to confirm the current algorithm.
Generate a new DKIM key pair using rsa-sha256—use your email service’s key generator tool or a command-line utility like openssl genpkey -algorithm RSA -pkeyopt rsa-sha256 -out dkim_private.pem. The new key must use the rsa-sha256 algorithm, not rsa-sha1, which is deprecated.
Update the DKIM selector record with the new public key and algorithm. Replace the old dkim=rsa-sha1 with dkim=rsa-sha256 in the TXT value, and ensure the public key is correctly formatted, with no line breaks.
Publish the updated DNS record immediately. DNS changes take 1–5 minutes to propagate. Use tools like Google Public DNS or MxToolbox to verify the new record is active.
Test the new signature with a DKIM validation tool. Enter your domain and selector to confirm the algorithm is now rsa-sha256 and alignment checks pass. Some systems, like Gmail, will reject emails with outdated algorithms.

Why this matters for deliverability

Google announced in 2021 that it would begin ignoring rsa-sha1 signatures in favor of stronger algorithms. Using weak cryptography can lead to messages being marked as spam, rejected, or deprioritized in inboxes. The shift to rsa-sha256 aligns with RFC 8301, which updates email signature standards for security and integrity.

After updating, monitor your delivery rate and bounce logs. If you use third-party platforms, confirm they support rsa-sha256 in their DKIM setup. If you're unsure whether your system is compliant, verify your domain’s DNS records using a tool like MailTester’s inbox placement checker—it includes real-world DKIM validation against major inboxes.

What happens if you don’t update to rsa-sha256?

If you continue using rsa-sha1 for DKIM, your emails risk being filtered by Gmail and other major inboxes, even if they’re legitimate. Authentication failures can hurt your sender reputation and lower deliverability—potentially by 20% or more for domains still relying on the outdated algorithm.

Key risks of delaying the rsa-sha256 transition

You may experience higher bounce rates or messages silently dropped by Gmail’s enhanced filtering systems.
Failed DKIM checks from outdated cryptographic signatures can be interpreted as signs of poor email hygiene, triggering reputation penalties.
Gmail’s Postmaster Tools will flag your domain if it detects rsa-sha1, indicating non-compliance with current authentication standards.
Many ESPs and large inbox providers now prioritize or exclusively accept rsa-sha256-signed messages, making older versions less likely to pass security checks.
Even if your emails technically deliver, they’re more likely to land in spam, especially in competitive industries like e-commerce or financial services.

How to verify your setup is compliant

Let’s be clear: no tool can fully simulate a real inbox’s judgment—but you can test whether your domain’s DKIM records are correctly configured for modern standards.

Use a real-time email verification tool to check if your messages are passing authentication checks across multiple inboxes. Test inbox placement across major providers like Gmail, Yahoo, and Outlook.
Verify that your DNS TXT record includes rsa-sha256 as the digest algorithm, not rsa-sha1, using tools like MXToolbox or the DKIM RFC 6376.
Test your email streams through a service that validates SPF, DKIM, and DMARC together—this shows if your full chain of authentication is solid.
Monitor your domain’s reputation via tools like Google’s Postmaster Tools. A persistent red flag on the "Authentication" score means your DKIM setup is out of sync with current recommendations.

Legacy algorithms like rsa-sha1 were never designed to withstand modern computational attacks. The shift to rsa-sha256 isn’t about compliance—it’s about maintaining the integrity of your email stream.

How to verify your DKIM signature uses rsa-sha256

You can confirm your DKIM signature uses rsa-sha256 by retrieving a recent email sent from your domain, checking the DKIM-Signature header for the a=rsa-sha256 parameter, and validating the result across multiple inboxes using tools like MxToolbox or MailTester’s inbox placement tests. This ensures compliance with Gmail’s security requirements and reduces the risk of your messages being marked as suspicious.

Step-by-step verification process

Retrieve an email from your domain using a mail client, SMTP log, or email archive. Make sure it was sent after your DKIM configuration was updated. You’ll need access to the raw email headers to inspect the DKIM-Signature field.
Open the email’s full headers and locate the DKIM-Signature header. Look for the a= tag within it. It should read a=rsa-sha256 — not a=rsa-sha1, a=rsa, or any alternate algorithm.
If you find a=rsa-sha1, your signature still uses the outdated algorithm. This is known to trigger filtering rules in modern email systems like Gmail and Outlook, even if your DNS records are correct.
Use a tool like MxToolbox’s DKIM Lookup to test the public key and verify signature alignment. It can help catch misconfigurations that aren’t visible in individual headers.
For deeper validation, run an inbox placement test through MailTester’s inbox placement checker. It simulates delivery across real inboxes, including Gmail, and confirms both the presence of the correct DKIM algorithm and its successful verification.

Why this matters: the consequences of outdated DKIM

Gmail has moved away from accepting emails signed with rsa-sha1 since 2022. While older systems may still process them, they’re more likely to be flagged as low integrity or rejected outright. The IETF’s RFC 8301 recommends SHA-256 for digital signatures in email, particularly for DKIM, due to the known weaknesses of SHA-1.

Even a single email sent with an older algorithm can harm your sender reputation. Email providers use cryptographic checks like DKIM to assess trustworthiness. If your domain consistently sends signed messages using outdated algorithms, it may be throttled, quarantined, or blocked.

Let’s be clear: verifying DKIM isn’t optional. It’s a core part of email deliverability. Use the steps above to ensure you’re not just compliant, but resilient.

Common pitfalls when migrating DKIM from rsa-sha1 to rsa-sha256

You’re migrating DKIM to rsa-sha256 for Gmail compliance? The biggest mistakes are forgetting to update both the private key on your server and the public key in DNS, typing the selector name wrong, letting DNS cache delay propagation, or generating weak keys. These errors cause send failures or spam marks even when you’ve done everything else right. Let’s break down how to avoid them.

Key synchronization failures

Don’t assume updating one half (DNS or server) is enough—both must match. A mismatch means Gmail rejects your signature, even if your email appears legitimate.
Double-check your DNS record syntax. A missing space or incorrect base64 encoding breaks validation. Use a tool like MXToolbox’s DKIM validator to spot these issues early.
Use the same selector across both systems. If your server expects selector=2024, but your DNS record uses selector=2023, signing fails silently.

Propagation and key generation issues

Don’t expect changes to take effect immediately. DNS TTL settings can keep old records in cache for hours. Monitor propagation with tools like DNSChecker.org to verify global rollout.
Never use weak key pairs. 1024-bit keys are insufficient. Use at least 2048 bits for RSA keys. Many platforms auto-generate weak keys—inspect the output.
Let’s be honest: re-signing thousands of emails with a new key during migration is error-prone. Use your email platform’s built-in DKIM tools, or test with a small batch first.

Even with correct keys, some providers delay DMARC alignment checks—Gmail can take 24–48 hours to fully validate new signatures. Monitor your inbox placement using a real inbox tester to confirm your emails are not marked as spam after migration. You can test this directly with our inbox placement tester to see how your domain performs across Gmail, Yahoo, and Outlook.

How does domain-wide email verification help with DKIM migration?

You reduce the risk of sender reputation damage during DKIM migration by cleaning your email list beforehand. Invalid, catch-all, or role-based addresses can cause bounces, especially when new DKIM policies tighten acceptance. Validating your entire list ensures only deliverable addresses remain, minimizing failures when you switch to rsa-sha256. This keeps your domain reputation stable throughout the transition.

Preventing failures during DKIM rollout

When you update your DKIM signature to rsa-sha256, Gmail and other mail providers enforce stricter validation. Sending to invalid or role-based addresses — like admin@ or support@ — often results in immediate rejection or bounce. These bounces can trigger spam filters or affect your sender reputation, especially if they occur at scale.

Let’s be clear: you don’t want to trigger a spike in bounces the moment you switch DKIM. It’s not just about email delivery — it’s about proving you’re a responsible sender. A list riddled with outdated or non-existent addresses undermines your credibility, even if your DNS settings are technically correct.

Using MailTester to audit your list

Before you activate rsa-sha256, use domain-wide email verification to identify and remove invalid, disposable, and catch-all addresses. MailTester’s bulk verification checks every address in your list against real-time SMTP, MX, and catch-all detection systems. It flags addresses that will bounce, ensuring you only send to confirmed, deliverable recipients.

MailTester’s 98.9% accuracy means you’re not over-cleaning. You won’t accidentally exclude valid users—especially important for campaigns with limited email volume or time-sensitive outreach. The tool distinguishes between real deliverable addresses and high-risk ones, including role accounts and temporary domains.

Start with a free 100-verification trial. Test your list with the bulk email verification tool to see how many addresses are risky or invalid. Then, clean your list and proceed with your DKIM migration. This simple step prevents delivery issues and ensures your domain-wide email policy works as intended.

What to check immediately after updating DKIM to rsa-sha256

After updating DKIM to rsa-sha256 for Gmail compliance, verify that your emails still deliver reliably. Check bounce rates, confirm DKIM signatures pass in headers, test inbox placement across Gmail, Outlook, and Apple Mail, and ensure SPF and DMARC alignment. Small misconfigurations can trigger filtering even after a successful key update.

Immediate Post-Update Validation

Monitor bounce rates in your email platform (Mailchimp, SendGrid, etc.) for a spike in permanent failures—especially 5xx errors—within 24–48 hours after the update.
Inspect raw email headers from delivered messages to confirm the DKIM-Signature header now uses rsa-sha256 and passes validation. Tools like MXToolbox or RFC 6376 define expected formats and can help verify syntax.
Run inbox placement tests using a real-time delivery report tool to check delivery status across Gmail, Outlook, Apple Mail, and other major providers. Some platforms may reject messages with mismatched or improperly formatted DKIM algorithms.
Verify that your SPF and DMARC policies still align with the updated DKIM selector and domain. If your SPF record doesn’t permit the sending domain, or DMARC fails alignment, delivery may still fail even with valid DKIM.
Test email delivery with known disposable domains and catch-all addresses to ensure your infrastructure doesn’t falsely fail valid messages during validation—especially after key changes.

Tools and Processes to Trust

Use MailTester’s inbox placement tester to send real messages across multiple providers and analyze how they land—helpful for spotting subtle filtering behavior post-DKIM update.
Validate your full mail flow with a bulk email verification tool before sending to a large list; tools like MailTester’s list verification can catch invalid or problematic addresses early.
For automated workflows, integrate MailTester’s email verification API to validate addresses in real time during onboarding or campaign prep.

Does every email service provider support rsa-sha256 DKIM?

Not every email service provider supports rsa-sha256 DKIM yet, but most modern platforms—like SendGrid, Amazon SES, Mailgun, and Postmark—have fully adopted it. Legacy systems or older email infrastructure may still require manual updates or may not allow the new algorithm at all. Always check your provider’s documentation to confirm algorithm compatibility before making changes.

Modern providers are mostly compliant

SendGrid, Amazon SES, Mailgun, and Postmark all support rsa-sha256 as a standard DKIM signing option. These providers updated their infrastructure to align with modern email security standards, particularly in response to Google’s 2023 move to deprecate rsa-sha1 in Gmail. If you're using one of these services, you can likely switch without major configuration hurdles.

Legacy systems need care

Older platforms or self-hosted email setups may not support rsa-sha256 out of the box. Some require custom DNS records, updated DKIM key generation tools, or specific configuration steps to enable the new algorithm. In these cases, you may need to dig into the provider’s API or support channels, or even consider upgrading to a more secure, compliant service.

When in doubt, consult your email provider’s official documentation. If they don’t mention rsa-sha256 support, it’s unlikely to be available. You can also check the latest email authentication standards at RFC 8301, which specifies the current industry-wide recommendations for DKIM key algorithms.

If your current provider does not support rsa-sha256—especially if you're seeing authentication failures with Gmail—it’s worth evaluating whether a migration is more efficient than attempting manual fixes. For high-volume senders, moving to a provider that supports modern authentication reduces the risk of inbox placement issues and helps maintain a strong sender reputation.

Proactive checks for email deliverability issues go beyond DKIM. Use real inbox placement testing to verify how your messages perform across major providers. Test your email in actual user inboxes before sending to catch authentication or content problems early. Even the best config can fail if content triggers spam filters, so verification tools are essential.

Can you use both rsa-sha1 and rsa-sha256 DKIM records simultaneously?

You should not use both rsa-sha1 and rsa-sha256 DKIM records at the same time. Gmail and most major ISPs accept only one DKIM signature per message. Having multiple records can cause alignment failures, lead to rejection, or trigger spam filters. Transitioning to rsa-sha256 should be complete—do not mix algorithms during rollout. Keep rsa-sha1 only temporarily for validation, then retire it once you confirm deliverability with the new signature.

Why mixing DKIM algorithms causes issues

Most email receivers validate only the first DKIM signature they find. If you have multiple records, the outcome depends on which one is processed first.
Even if both signatures are technically valid, misalignment between the selected key and the domain’s SPF or DMARC policy can result in a failed authentication chain.
Some systems, including Gmail’s internal filtering, may reject messages with conflicting or mismatched DKIM results—even if one signature is correct.
Using both types increases the risk of misconfiguration. You’re not gaining security; you’re adding complexity without a net benefit.

Best practice: full transition, not gradual overlap

Deploy rsa-sha256 signatures first and test deliverability using a small batch of emails.
Use tools like inbox placement testing to verify that messages land in the inbox and pass authentication checks.
Continue sending with the old rsa-sha1 record only during a limited, monitored rollback window to catch unexpected failures.
Once you confirm inbox placement and low bounce rates with rsa-sha256, remove the rsa-sha1 record entirely.
Don’t assume “backwards compatibility” means you can keep both. Modern standards require newer algorithms, and older ones are deprecated.

For the latest guidance on cryptographic standards in email, refer to RFC 6376 (DKIM), which outlines the evolving requirements for DKIM signatures.

Why DKIM is a critical part of inbox placement

DKIM ensures emails sent from your domain are authentic and unchanged in transit. Gmail and other major inboxes use DKIM to verify that messages weren't tampered with and originated from an authorized source. A weak or mismatched DKIM signature can push your emails straight to spam, even if your SPF and DMARC are correct. Let’s break down how this fits into real deliverability.

Drafts that fail verification trigger filtering

When an email leaves your server, DKIM adds a digital signature tied to your domain's public key. Receiving servers check this signature against published DNS records. If it fails, the message is flagged—even if the content looks clean. Inconsistent DKIM setups (like mixing multiple signing methods or using outdated algorithms) cause validation failures that spam filters see as red flags.

Gmail, Microsoft, and others use the presence of valid DKIM as a baseline signal for inbox placement. If DKIM validation fails repeatedly, your sending reputation takes a hit. That means fewer emails land in inboxes and more go to spam folders, even for legitimate campaigns.

Alignment across SPF, DKIM, DMARC is non-negotiable

DNS records work best when SPF, DKIM, and DMARC are aligned. Think of them as a three-part trust system: SPF says who sent it, DKIM confirms it wasn't changed, and DMARC defines what happens if either fails. When one is broken—or worse, inconsistent—the chain breaks. A domain with misaligned or missing signatures sees inbox placement drop dramatically.

For example, a campaign with valid SPF but outdated DKIM (like rsa-sha1) might pass validation—but it's still treated with suspicion. Modern providers, including Gmail, now require modern algorithms like rsa-sha256 to maintain trust. Using old crypto reduces your sender reputation over time.

That’s why tools like MailTester’s inbox placement testing matter. They simulate real-world inbox conditions using actual mail servers. You can catch DKIM misconfigurations before sending to your audience, validate alignment across protocols, and fix issues before they hurt your deliverability.

For deeper validation, MailTester’s email checker can spot issues like mismatched signatures or outdated algorithms at scale. Whether you're updating DKIM or auditing your entire sending setup, catching flaws early prevents wasted sends and damaged sender reputation.

Conclusion: Update now to maintain inbox access with Gmail

Gmail’s enforcement of rsa-sha256 for DKIM is no longer a recommendation — it’s a requirement for maintaining consistent inbox placement. Falling behind risks higher bounce rates and delivery failures.

Migrating from rsa-sha1 to rsa-sha256 is a precise technical update with measurable impact on sender reputation and delivery success. The process is manageable with proper DNS configuration and validation.

Always verify your email list quality and monitor DNS changes before and after deployment. Use real-world testing tools to ensure your setup works across Gmail and other major inboxes.

Sources

After Gmail began requiring authentication for large senders, the number of unauthenticated messages Gmail users received plummeted by 75%. — Google (The Keyword blog) (2023)
Google reported 265 billion fewer unauthenticated messages sent to Gmail users in 2024 — a 65% reduction — after its bulk-sender rules took effect, with 500,000+ top domains publishing DMARC records in response. — Google (via MailOver bulk-sender requirements guide) (2024)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does Gmail still accept rsa-sha1 DKIM?

No. Gmail requires rsa-sha256 and rejects messages with rsa-sha1 signatures to maintain security standards.

How long does it take for updated DKIM to take effect?

DNS propagation typically takes 1–24 hours, but TTL settings and caching can extend this window.

What is the difference between rsa-sha1 and rsa-sha256?

rsa-sha256 uses a stronger hashing algorithm (SHA-256) than rsa-sha1 (SHA-1), which is now considered cryptographically weak.

Can I test my DKIM signature before changing DNS?

Yes. You can sign test messages locally or via SMTP with the new key and inspect headers before publishing.

How do I find my DKIM selector?

The selector is the first part of the DKIM TXT record name — usually `default._domainkey` or `selector1._domainkey`.

Do I need to regenerate my entire email infrastructure for rsa-sha256?

No — only the DKIM key pair and DNS record need updating. Most MTAs and platforms support the new algorithm.

Does MailTester check DKIM validity?

Yes — MailTester’s inbox placement tests and real-time API validate DKIM alignment and signature strength.

What should I do if my DKIM test fails after migration?

Verify DNS record syntax, check for typos in the selector, confirm the key is correctly installed, and re-test after cache expiration.

Can role accounts cause DKIM validation issues?

No — DKIM validates signatures per domain, not per address. But role accounts can harm sender reputation if used in bulk campaigns.

Why is my sender reputation dropping after DKIM changes?

It likely indicates misconfiguration. Re-check DNS records, ensure signatures are properly generated, and test with a clean list.

How often should I audit DKIM settings?

At least quarterly, especially after platform updates, or if you notice spikes in bounces or spam complaints.

Can I use MailTester to verify my entire email list before migration?

Yes — MailTester’s bulk verification API and in-app AI assistant can clean and validate lists to reduce bounce risk during transitions.