Update RSA-SHA1 DKIM Keys

Why are RSA-SHA1 DKIM keys still in use, and when should you update them?

You're sending emails through cPanel or Cloudflare, and your inbox placement is dropping. Your DKIM signature shows "rsa-sha1" — a key you’ve never touched in years. Why does it still work at all?

Many email systems still accept RSA-SHA1, not because it’s secure, but because legacy infrastructure hasn’t caught up. It’s like using a dial-up modem in a fiber-optic world — it works, but it’s a vulnerability waiting to trigger filters.

This guide walks you through how to update RSA-SHA1 DKIM keys in cPanel or Cloudflare email settings, explains when it's urgent, and why skipping the update risks spam flags or outright rejection.

Key takeaways

DKIM keys using rsa-sha1 are deprecated by modern security standards but may still be required for older mail receivers.
Updating keys to rsa-sha256 or ed25519 is essential after security alerts or when using third-party email services.
Failing to update expired or weak keys can cause email rejection, reduced deliverability, or classification as spam.

What happens if your DKIM keys are outdated or misconfigured?

If your DKIM keys are outdated or misconfigured, emails from your domain may fail authentication checks, leading to rejection by major providers like Gmail and Outlook. This breaks SPF/DKIM alignment, harms your sender reputation, and results in high bounce rates or delayed delivery—often without clear error messages. You’ll see inbox placement drop sharply, especially with strict filters. Let’s look at the real consequences.

Common signs your DKIM setup is failing

Receiving servers reject your messages even when SPF passes—this often indicates DKIM alignment failure, as confirmed by industry reports from RFC 6376, which defines DKIM’s role in email authentication.
Your email volume increases, but delivery rates decline sharply over a few days without changes to content or list hygiene—this is a red flag for degraded authentication.
Reports from providers like Google or Microsoft show "authentication failed" or "DKIM signature not verified," even if your SPF and DMARC are correct.
Mailbox providers mark your emails as spam or send them to the junk folder by default, even when no spam triggers exist, due to poor sender reputation.
Bounce rates spike—especially “hard” bounces that appear without a valid email address, often because the domain-level signature fails, not the address.

How long before reputation suffers?

Reputation damage begins within 48 to 72 hours of consistent authentication failures, especially with large senders.
Even a single misaligned message can trigger filtering rules in high-volume systems; repeated failures make recovery harder.
Providers like Gmail use real-time reputation signals—every failed DKIM check adds weight to a risk score that may take weeks to reverse.
Once blocked, re-verification by receiving servers can take days, and some blocklists may flag your IP or domain for weeks.
There’s no "fix and forget"—you must monitor alignment continuously; misconfigurations often return after a server update or DNS change.

You don't need to wait for a full outage to act. Use MailTester’s inbox placement test to check how your messages land across Gmail, Outlook, and other major inboxes—and catch alignment issues before they hurt deliverability.

How to update RSA-SHA1 DKIM keys in cPanel

You can update your RSA-SHA1 DKIM keys in cPanel by logging in, going to the Email section, selecting DKIM, choosing your domain, generating a new key with RSA-SHA1 as the type, copying the public key, adding it to a DNS TXT record at mail._domainkey.yourdomain.com, and waiting up to 48 hours for propagation. This ensures your emails continue to pass authentication checks and avoid spam filters.

Navigate to the DKIM settings

Log in to cPanel using your administrative credentials. You must have full access to the email tools section.
Locate and click on the “Email” section in the dashboard. It’s typically under the “Mail” category.
Select “DKIM” from the list of mail tools. This opens the DKIM management interface where you can generate, view, or regenerate keys.

Generate and deploy the new key

Find the domain for which you’re updating the DKIM key. You can manage multiple domains here; ensure you choose the correct one.
Click “Generate New Key” or “Regenerate” if you’re replacing an outdated key. This process creates a new cryptographic signature tied to your domain.
When prompted, explicitly select RSA-SHA1 as the key type if options are available. Some systems default to newer standards like RSA-SHA256, but if you’re required to use RSA-SHA1 (e.g., for legacy compatibility), this step is critical.
After generation, copy the full public key string displayed — it starts with “v=DKIM1; k=rsa; p=” and extends for multiple lines.
Go to your domain’s DNS management (via your hosting provider or domain registrar), and create a new TXT record with the name mail._domainkey.yourdomain.com. Paste the full public key into the value field.
Save the DNS record. DNS changes can take up to 48 hours to propagate globally, so expect delays in authentication verification.

Once propagated, outgoing emails from your domain will carry the new DKIM signature, improving sender reputation and inbox placement. Some email providers, like Google and Yahoo, still validate DKIM signatures — a mismatch can result in delivery failures.

The 3 steps described in “Navigate to the DKIM settings”, in order.

After updating, verify your setup using a tool like the DKIM checker from DNSChecker.org or test with MailTester’s inbox placement tester to confirm your messages are authenticating correctly and landing in inboxes, not spam folders.

How to update RSA-SHA1 DKIM keys in Cloudflare Email Settings

You can update RSA-SHA1 DKIM keys in Cloudflare by logging into your Cloudflare account, navigating to Email Routing, finding the DKIM section under Domain Keys, checking the current key’s validity, generating a new key pair if needed, copying the public TXT record, adding it to your DNS zone, and waiting up to 48 hours for propagation. Use a DKIM verifier tool to confirm success. This ensures emails sent from your domain are properly authenticated—critical for deliverability.

Step-by-step update process

Log in to Cloudflare and select the domain you want to update. This ensures you're working with the correct email configuration.
Go to Email in the left-hand menu, then open Email Routing (or Mail Settings, depending on your plan). This is where Cloudflare manages email routing and authentication.
Locate the DKIM configuration section—look for “Domain Keys” or “DKIM Keys.” You’ll see existing keys listed with their status and expiry.
Check if the key has expired or is invalid. RSA-SHA1 keys typically expire after a set period; if so, you must generate a new key. You can validate this using tools like dmarc.org’s DKIM checker or similar industry-standard validators.
Generate a new RSA-SHA1 key pair directly in Cloudflare’s interface if one isn’t already active. Cloudflare will create both the private and public keys for you.
Copy the full public TXT record, including the quotes around the value. This record must match exactly—any typo breaks authentication.
Go to your DNS zone in Cloudflare and add a new TXT record. Paste the copied value, ensuring it goes into the correct name field (usually default._domainkey.yourdomain.com).
Wait up to 48 hours for DNS propagation. During this time, email authentication is unstable. Use a verification tool like MailTester’s inbox placement tester to check if emails are now being marked as authenticated.

Why this matters

Digital signatures like DKIM verify that an email wasn’t tampered with in transit. An outdated or missing key means your messages can be marked as suspicious or blocked. While RSA-SHA1 is considered legacy, it’s still supported by many mail servers—including older enterprise systems—so updating it correctly maintains deliverability.

Regular key rotation improves security posture and prevents email spoofing. Even after setup, use tools like MailTester’s email checker to validate addresses before sending, reducing bounces and protecting sender reputation.

Key differences between cPanel and Cloudflare DKIM management

You manage DKIM in cPanel per domain through its Email Services module, manually adding DNS TXT records after key generation—often with RSA-SHA1 by default in older versions. Cloudflare handles DKIM at the DNS level, automatically signing outbound emails using its mail relay and injecting TXT records without manual effort. It supports both RSA-SHA1 and SHA256, and logs delivery signals for visibility. If you’re verifying email infrastructure, testing deliverability helps catch DMARC misconfigurations or missing signatures before they impact sending.

How each platform handles key setup and updates

In cPanel, generating a DKIM key triggers a local process, but you must copy the resulting TXT record and paste it into your domain’s DNS zone—typically done via the DNS Zone Editor. This step is easy to miss or misconfigure, especially on large domains with many records. If you later update the key, you must repeat the manual DNS update. In contrast, Cloudflare’s DKIM setup is transparent and automated: after enabling the feature, it creates the record in your DNS zone instantly and manages rotations if enabled. This reduces human error, particularly relevant when deploying bulk campaigns.

Cloudflare’s approach relies on its email relay infrastructure. All outbound mail passes through Cloudflare’s servers, where DKIM signing occurs during delivery. That means you don’t need to manage multiple keys across different email systems. This also allows Cloudflare to track DKIM alignment, SPF results, and DMARC enforcement signals, feeding them into its dashboard. These metrics help you validate that your email authentication stack is intact and reduce the risk of mail being marked as spam. cPanel offers no such logging or reporting; you’re on your own when diagnosing delivery issues.

Key technical and operational distinctions

While both platforms support RSA-SHA1, Cloudflare also defaults to SHA256, which is considered more future-proof and aligned with modern email security standards. Older cPanel instances may not offer SHA256 at all, or require a manual update. This can limit email provider trust, especially with providers like Gmail or Apple Mail that prefer stronger hashes. For organizations using multiple services or migrating email infrastructure, Cloudflare’s unified approach helps standardize authentication. cPanel requires you to track and maintain DNS entries across each domain, increasing complexity.

When auditing your sending infrastructure, especially after making changes to DKIM, verify the outcome with real-world tests. Use MailTester’s inbox placement tool to see how your emails land in real inboxes with live filters applied.

How to verify your DKIM key is active and correctly published

You can confirm your DKIM key is active by checking your DNS TXT record for mail._domainkey.yourdomain.com using a tool like MxToolbox or DKIMCore. Run a DNS lookup, ensure the record contains v=DKIM1; k=rsa; p=... and matches your key exactly. Then, send a test email to Gmail or Outlook, open its 'Show original' header, and verify the DKIM-Signature includes the correct domain and key size. This confirms your setup is working.

Step-by-step verification checklist

Use a free DNS tool like MxToolbox or DKIMCore to query your DNS records.
Look up the TXT record at mail._domainkey.yourdomain.com, replacing yourdomain.com with your actual domain.
Verify the record's content starts with v=DKIM1;, includes k=rsa;, and has a correct p=... value that matches your generated key.
Send a test email to a Gmail or Outlook account.
Open the email, click 'Show original' in Gmail or the equivalent in Outlook.
Search for the DKIM-Signature header and confirm it includes your domain and the key size (usually 1024 or 2048 bits).
Check that the Received-SPF or Authentication-Results header shows pass for DKIM, not fail or neutral.
If you’re using a third-party email service, ensure Cloudflare's email settings aren’t overriding your DNS changes.
Be aware that DNS propagation can take up to 48 hours; wait if you've just updated the record.

Why consistency matters

DNS errors, typos, or incomplete records are common causes of DKIM failures. Even a single extra space in the p= value can break the signature. The DKIM RFC 6376 specifies exact syntax rules — tools like MxToolbox automatically validate compliance.

If you're managing large email volumes, use a service like MailTester’s email checker to validate addresses ahead of sending. This helps prevent deliverability issues rooted in incorrect sender configurations.

Why should you test email deliverability after updating DKIM keys?

Updating your DKIM keys is only half the battle. Even if the new keys are correctly published, your messages can still fail to deliver if your SPF or DMARC policies aren’t aligned with them. Let’s say you’ve changed your DKIM signature in cPanel or Cloudflare — great. But if the alignment check between SPF, DKIM, and DMARC fails, mail servers may reject your email entirely, regardless of valid cryptographic signatures. This is because modern email systems don’t validate each policy in isolation. They cross-reference all three: SPF, DKIM, and DMARC — and require alignment to trust the sender. A single mismatch can block the entire message, and you might not see an error until hundreds or thousands of emails fail silently.

Alignment is non-negotiable

DKIM signs the message body and headers, but it doesn’t guarantee delivery. What does? Alignment. The receiving server checks whether the domain in the DKIM signature matches the domain in the "From" header and the result of the SPF check. If any of these domains don’t align (e.g., your DKIM key says it’s from mail.example.com, but SPF says it’s from example.com), the email is marked as suspicious. According to RFC 7672, this alignment process is a core part of DMARC enforcement. So even with a valid DKIM key, misalignment leads to rejection. This is why you shouldn’t assume your email will reach inboxes just because you updated the key.

Testing reveals real-world delivery behavior

Most providers won’t send you back a bounce when your alignment fails — especially if the policy is strict but misconfigured. You could send a campaign, see a 99% success rate, and still have 30% of messages land in spam or get silently dropped. Without testing, you have no visibility until something breaks at scale. That’s where inbox placement testing becomes critical. You can simulate real-world delivery using tools that send messages to major mail providers like Gmail, Outlook, and Yahoo, then report whether they land in the inbox or are filtered. If your DKIM key is misaligned, this test will catch it before an email blast launches. You can verify your config with a simple inbox placement test at MailTester’s inbox tester, which mirrors how actual mail servers assess your setup. Even if all your technical settings look correct, only delivery testing confirms if your messages behave as expected in practice.

Use MailTester to verify deliverability and inbox placement

After updating your RSA-SHA1 DKIM keys in cPanel or Cloudflare, send a test email via MailTester’s inbox-placement testing to confirm it lands in the primary inbox — not spam. The tool checks real-time alignment of SPF, DKIM, and DMARC across major providers like Gmail, Yahoo, and Outlook, giving you objective proof your configuration works.

Validate your setup with real-world testing

Use MailTester’s inbox placement tester to send a sample email to a real inbox from your domain.
The tool reports placement in the primary inbox, promotions tab, or spam folder — not a simulated result, but actual feedback from major email providers.
It verifies SPF, DKIM, and DMARC alignment in real time using current, industry-standard checks — no guesswork.
Results include detailed diagnostics on alignment failures, key mismatches, or authentication gaps that might cause rejection.

Automate validation for reliable deployments

Integrate the MailTester API into your deployment workflow to test deliverability automatically after any config change.
Use the API during staging or post-deployment to catch issues before sending to your full audience.
Combine this with bulk list verification at MailTester’s list checker to clean your email list and reduce bounce rates.
For one-off checks, use the email checker to validate individual addresses before sending.

Authentication is only as strong as its proof. Even a correctly configured DKIM key can fail in practice due to timing, caching, or alignment issues. MailTester doesn’t report “your keys are set” – it tells you if the email actually arrives in the inbox. This kind of real-time, provider-agnostic testing aligns with best practices defined in RFC 5322 and RFC 6376. Major providers still treat inconsistent or weak DKIM signatures as red flags — especially when combined with outdated algorithms like RSA-SHA1. While SHA-1 is not deprecated by RFC 8352, it is increasingly scrutinized by providers, so validating the full chain of trust is essential.

Don’t assume your keys work. Test from the recipient’s perspective — that’s the only way to know.

What are the risks of not updating outdated or weak DKIM keys?

You risk letting attackers spoof your domain, trigger spam flags, get blocked by major email providers, and damage your sender reputation—all of which hurt deliverability and make scaling email campaigns harder. Old or weak DKIM keys like RSA-SHA1 no longer meet modern security standards, leaving your domain exposed to abuse.

Why outdated DKIM keys still matter today

Many email systems still evaluate cryptographic strength as part of sender reputation. Using deprecated algorithms increases the odds your mail gets flagged or rejected, even if your content is clean. It's not just about compliance—it’s about trust.

Increased risk of email spoofing or phishing attempts masquerading as your domain. Attackers can exploit weak signatures to send messages that appear to come from your brand, especially if your domain lacks stronger validation like DMARC enforcement.
Reputational damage when emails are flagged or blocked by recipients. Once your domain appears in a phishing report or spam alert, recovering trust takes time—even if you’ve fixed the technical issue.
Higher likelihood of being added to blocklists after multiple signature failures. Systems like Spamhaus or MXToolbox monitor sending behavior; repeated use of outdated crypto can trigger automated blacklisting.
Loss of trust with email providers that prioritize strong encryption. Major inboxes like Gmail and Outlook now require or strongly favor modern signing standards like SHA-256 with RSA or ECDSA, and may throttle or drop emails from domains using deprecated keys.
Inability to scale email campaigns due to throttling or rejection. Providers may reduce delivery volume or reject messages altogether if your domain fails modern authentication thresholds, particularly in bulk sending scenarios.

How to stay ahead of the threat

Let’s not wait for a breach to act. Regularly audit your DKIM configuration—especially if you use cPanel or Cloudflare Email Routing. Tools like inbox placement tests can help you validate how your messages are received across real inboxes, including whether authentication succeeds.

As outlined in RFC 8301 (Section 4), modern email standards recommend moving away from SHA-1 for signing, and many major providers now require cryptographic algorithms with stronger security per established industry benchmarks. Maintaining up-to-date keys isn’t optional—it’s part of responsible email hygiene.

How to ensure ongoing DKIM key health and alignment

You should verify DKIM setup regularly by checking DNS records, monitoring delivery performance, and validating key integrity through automated tools. Regenerate keys every 12–18 months, audit records after infrastructure changes, and validate sender setup with a service like MailTester to catch issues before they impact deliverability.

Automate verification and monitoring

Set up automated checks using a domain monitoring tool or a simple script that queries your DNS records weekly to confirm DKIM is active and correctly published.
Use a service like MailTester’s inbox placement test to simulate real-world delivery and catch alignment issues early, especially after key updates.
Integrate MailTester’s real-time API into your send workflow to validate addresses and verify DNS settings at scale, reducing bounce rates.

Audit and renew keys proactively

Audit your DNS records annually or directly after any change to your email infrastructure, such as switching hosting providers or upgrading mail servers.
Regenerate DKIM keys every 12–18 months to reduce the risk of cryptographic compromise—this is a security best practice endorsed by RFC 6376, which defines DKIM.
Ensure all keys are properly re-signed and that your SPF and DMARC policies remain aligned—misalignment between SPF, DKIM, and DMARC can cause deliverability drops.
Test key validity using a tool like MailTester’s single address checker before deployment to confirm the key is correctly tied to the domain.

Monitor delivery reports from your ESP regularly. A sudden drop in inbox placement or increase in bounces often signals misalignment or expired keys. Tools like MailTester help isolate whether the issue is sender configuration, domain reputation, or infrastructure changes. Don’t wait for complaints—proactive checks prevent downtime and keep reputation strong.

Final takeaway: updating DKIM is not just a technical task — it’s a deliverability necessity

RSA-SHA1 keys are still functional in many environments, but they’re deprecated by modern security standards. Relying on them increases risk and can trigger filtering by receivers that enforce stricter authentication.

Changing DKIM keys without validating the outcome can disrupt email flow. A misconfigured key, even if technically correct, may result in rejected messages or poor inbox placement — errors that only real-world testing can catch.

Use inbox placement testing to verify that updated keys are working as intended. Don’t assume success based on configuration alone. Integrate email verification into your workflow to catch issues before sending at scale.

MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I use RSA-SHA1 with modern email providers?

Yes, many providers still accept RSA-SHA1, but newer systems prefer RSA-SHA256. Use RSA-SHA1 only if required by legacy systems or partners.

How long does it take for a new DKIM key to become active?

DNS propagation typically takes 1–48 hours. Full service activation may require additional cache clearings.

What happens if I delete or corrupt my DKIM public key in DNS?

Emails sent from your domain will fail DKIM checks, leading to bounces, rejections, or spam filtering.

Do I need to update both SPF and DKIM when changing keys?

Only update DKIM unless the SPF record points to the old server or includes the old key. SPF is independent but should be aligned.

Can cPanel or Cloudflare reconfigure DKIM automatically?

Cloudflare offers automatic key handling and propagation. cPanel requires manual DNS setup after key generation.

How often should I regenerate my DKIM keys?

Every 12 to 18 months to maintain security standards, even if they haven’t expired.

Does MailTester check DKIM alignment?

Yes, MailTester verifies SPF, DKIM, and DMARC alignment in real inbox testing across major providers.

What’s the best way to test DKIM after update?

Use a tool like MailTester to send a test email to a real inbox and check placement and headers for DKIM validation.

Is there a risk in having multiple DKIM records?

Yes — multiple DKIM records can cause alignment issues. Only one valid DKIM record per domain should exist.

Can I use a third-party email service with my own DKIM keys?

Yes, but you must publish the DKIM public key in DNS and ensure the sending service signs messages using that key.

Why does my email appear in spam after updating DKIM?

It may be due to misalignment with SPF, DMARC policy, or a recent change in sender reputation. Test with inbox placement tools.

Do I need to update DKIM keys if I change email providers?

Yes — especially if the new provider uses a different signing method or DNS configuration.

Sources

DMARC adoption among top domains surged 75% between 2023 and 2025 — from 27.2% to 47.7% — in the wake of Google and Yahoo's bulk-sender authentication requirements. — EasyDMARC 2025 DMARC Adoption Report (2025)
Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)