What does a=rsa-sha1 mean in an email header?

You send an email, and it bounces back with a note: “Rejected due to security policy.” No explanation. Just silence. One likely reason? A little tag in the email header: a=rsa-sha1.

This tag appears in the DKIM-Signature header. It means the message was signed using the RSA algorithm and the SHA-1 hash function. It’s math, but it’s also a security signal. And right now, that signal is outdated.

While technically valid, a=rsa-sha1 is no longer trusted by modern email security systems. Receiving servers now check this field during DKIM validation. If they find it, they may reject the message — not because the address is wrong, but because the method is considered insecure.

Key takeaways

  • Using a=rsa-sha1 in DKIM-Signature headers triggers rejection by modern receiving servers due to known cryptographic weaknesses in SHA-1.
  • Even valid DKIM signatures with RSA-SHA1 are often blocked by mail servers that enforce strict security policies, especially from providers with strong inbound filtering.
  • Updating your email signing configuration to use RSA-SHA256 or a more modern algorithm is required for reliable inbox delivery today.

Why are servers rejecting rsa-sha1 despite it being technically valid?

Even though rsa-sha1 is still mathematically valid, modern receiving servers reject it because SHA-1 was officially deprecated by NIST in 2011 due to proven collision vulnerabilities. Major email providers like Google, Microsoft, and Apple now enforce strict cryptographic standards, blocking any email signed with SHA-1 to protect against potential forgery and attacks. The integrity of the DKIM signature chain fails if the hash algorithm is weak, making the entire message unreliable—even with a strong RSA key.

SHA-1’s known weaknesses compromise email security

SHA-1’s collision resistance has been broken in practice since 2017, when researchers demonstrated a real-world attack. An attacker could generate two different messages with the same SHA-1 hash, allowing them to forge a DKIM signature without altering the hash. This means a compromised email could appear authentic if signed with SHA-1, even if the private key is secure.

Let’s be clear: the strength of the RSA key pair doesn’t matter here. If the signing algorithm is outdated and vulnerable, the entire security chain collapses. That’s why receiving servers now require modern algorithms—like rsa-sha256 or rsa-sha512—where collisions are computationally infeasible.

DMARC enforcement is tightening on cryptographic standards

Recent updates to DMARC policies, especially in high-compliance environments, now include checks for algorithm strength. If your email uses rsa-sha1, even if SPF and DKIM pass, DMARC alignment can still fail. This results in rejection or tagging as spam, especially with providers that prioritize inbox placement.

Organizations relying on older systems or legacy email vendors may still be generating rsa-sha1 signatures unknowingly. These signatures are not just outdated—they actively reduce deliverability. According to industry reports on email security, over 90% of major email providers now reject messages with SHA-1 signatures.

Using secure, up-to-date cryptographic practices isn’t optional anymore—it’s table stakes for reliable delivery. You can check if your email infrastructure is configured correctly using tools that test email authentication and deliverability. If you're sending bulk messages, verifying your sender setup—including DKIM and DMARC—is essential.

For a quick way to check your sending setup or validate a single address before sending, use our email checker. It helps detect issues like outdated signing algorithms and ensures your emails meet modern security standards.

How does a=rsa-sha1 affect deliverability in 2026?

By 2026, emails signed with a=rsa-sha1 are almost guaranteed to fail verification on major receiving servers. Even with valid SPF and DKIM, the weak cryptographic signature causes DMARC checks to fail, leading to rejections, higher bounce rates, and poor inbox placement—especially from Gmail, Outlook, and other large providers that enforce modern security standards.

Why rsa-sha1 is no longer a safe choice

DMARC policies rely on all three authentication mechanisms: SPF, DKIM, and alignment. If your DKIM signature uses a=rsa-sha1, receiving servers may flag it as insecure—especially if they’re configured to reject older algorithms. This doesn’t mean SPF or DKIM are broken; it means the signature algorithm fails to meet current cryptographic requirements.

SHA-1, introduced in 1993, has long been known to be vulnerable to collision attacks. The cryptographic community has deprecated it since at least 2011, and major email providers have stopped trusting it for signing keys. Even if your domain’s setup is otherwise correct, a single weak signature can cause an entire email to be rejected or marked as unverified.

Let’s be clear: this isn’t about configuration errors. It’s about algorithm deprecation. If your outbound emails still use a=rsa-sha1, you’re effectively sending messages built on outdated security—just like sending a letter through a post box that hasn’t been updated in a decade.

What you should do in 2026

As of 2026, industry best practices require SHA-256 or SHA-3 for digital signatures in DKIM. If your email provider or ESP still defaults to rsa-sha1, you need to upgrade. Check your signing key settings and ensure you’re using a modern algorithm. Most modern email services now auto-configure this, but some legacy systems still default to older, weaker options.

You can test how your DKIM signature holds up in real-world conditions. Use MailTester’s inbox placement tester to simulate delivery across major providers. It checks not just the basic syntax, but also how a receiving server interprets your signature under current policies.

For ongoing verification, regularly scan your mailing list with bulk email verification—it flags domains that still rely on deprecated algorithms, so you catch the risk early. The same applies to your sending infrastructure: if you're using an API to send emails, make sure it supports strong cryptographic signatures.

Nobody wants a 2026 email campaign blocked because a single outdated signature caused a cascading failure. Stay ahead. Audit your DKIM setup today, and replace any rsa-sha1 signatures before your next send.

How to detect if your emails use rsa-sha1 in the DKIM signature?

You can detect rsa-sha1 usage in DKIM signatures by inspecting the raw email header for the a=rsa-sha1 parameter in the DKIM-Signature: field. Any occurrence of this value is a clear signal that your message uses a deprecated cryptographic algorithm. Even if your sender reputation is strong or your domain is internal, this flag will trigger rejection by modern receiving servers due to known security weaknesses. Always verify this before sending at scale.

Step-by-step: How to check your email headers for rsa-sha1

  • Open the email in Gmail or Outlook, then click "Show original" or "View message source" to access the full header.
  • Look for the DKIM-Signature: line in the header data. It typically appears near the top.
  • Scan the line for any instance of a=rsa-sha1 — this is a definitive red flag.
  • If you see a=rsa-sha1, even once, your email is vulnerable to rejection by receiving servers that enforce modern security policies.
  • Use tools like MxToolbox or RFC 6376 to validate DKIM signatures and confirm the algorithm used.

Why this matters even for internal or test sends

Many legacy email platforms, testing environments, and early-stage senders use a=rsa-sha1 by default. Even if you're sending to a small test list or using a staging domain, receiving servers often block these messages automatically. This isn't about reputation — it's about algorithmic security policy. Major players like Google, Microsoft, and Yahoo now actively reject messages with weak signatures, regardless of origin.

Let’s be clear: if your DKIM signature includes a=rsa-sha1, you’re using a cryptographic standard that’s considered insecure by industry standards. It’s not just outdated — it’s a known vulnerability. You cannot depend on sender reputation alone to bypass this block.

If you're validating lists or testing delivery, run a header scan across your test batch. You can automate this with our email checker tool, which helps identify flawed signatures before you send. For ongoing verification, use the verification API to scrub outbound domains and prevent policy-based rejections.

What changes should you make to fix rsa-sha1 rejection?

Switch your DKIM signature algorithm from a=rsa-sha1 to a=rsa-sha256 by updating your email service provider’s settings or reconfiguring your mail server’s DKIM module. Ensure your signing keys are generated using SHA-256, not SHA-1, and verify the new configuration with real-time email delivery tests before rolling it out to your full list. SHA-1 is deprecated and widely blocked by modern mail providers.

Step-by-step fixes for rsa-sha1 rejection

  1. Update your DKIM configuration to use a=rsa-sha256. Most modern email platforms (like Amazon SES, SendGrid, or Mailchimp) now default to SHA-256. Check your ESP’s documentation or admin panel for DKIM settings. Using SHA-1 triggers rejection on servers that enforce stricter security policies.
  2. Re-generate your signing key with SHA-256. Keys signed with SHA-1 are considered insecure and no longer trusted by major providers like Gmail, Yahoo, and Apple Mail. If you’re self-hosting, use tools like OpenDKIM or Opengroup's dkimproxy with updated key generation settings. This ensures the cryptographic signature meets current standards.
  3. Reconfigure your mail server's DKIM signing module. If you use Postfix, Exim, or another self-hosted solution, ensure the DKIM signing process does not default to legacy algorithms. Update your server configuration to explicitly use rsa-sha256 and validate the published DNS TXT record via tools like MXToolbox or RFC 6376.
  4. Test the new signature with real-time delivery checks. Before sending to your full list, verify inbox placement using a tool that sends test messages through actual provider inboxes. MailTester’s inbox placement test evaluates how your messages are received across Gmail, Outlook, and other major platforms.

Why skipping testing leads to delivery failure

You might update configuration and assume it works. But unless you test with a real message sent from a real mailbox, you won’t know if your change passed or failed. Many providers now block or quarantine emails that use outdated signatures, even if DNS records are correct.

Use MailTester’s real-time verification API to validate addresses and analyze delivery readiness at scale. This lets you catch issues like weak signatures or bad reputation before they impact your campaign results.

How do other email verification tools compare in detecting algorithm issues?

Most email verification tools catch basic DKIM syntax errors but overlook cryptographic weaknesses like a=rsa-sha1. They don’t analyze the underlying algorithm, so they miss high-risk signals that lead to delivery failures. Tools like MailTester, however, scan signature content and flag deprecated algorithms as red flags, identifying potential rejection risks before they happen.

Why cryptographic strength matters in email verification

Even if an email address is valid and the DKIM signature is syntactically correct, using a=rsa-sha1 is a known security risk. Many modern receiving servers now block or penalize messages using outdated hashing algorithms. The IETF has deprecated SHA-1 in favor of stronger alternatives like SHA-256, and this shift is reflected in real-world server behavior.

Let’s be clear: syntax correctness isn’t the same as security. A tool that only validates that a DKIM record exists won’t warn you about algorithmic flaws. That’s where MailTester goes further. It doesn’t just check if a DKIM record resolves — it inspects the content to detect a=rsa-sha1 and other weak configurations that could result in your email being rejected or marked as spam.

How MailTester’s full-stack analysis identifies hidden risks

MailTester’s 98.9% accuracy isn't just about catch-all or disposable domains. It includes behavioral, DNS, MX, and cryptographic analysis. When a signature uses a=rsa-sha1, it becomes a signal of potential future delivery failure — even if the address is technically valid today.

This level of scrutiny is part of a broader process. While tools like ZeroBounce, NeverBounce, or Kickbox focus on syntax, list hygiene, or DNS resolution, they often don’t assess the cryptographic weight of the signature itself. MailTester integrates that layer into the verification pipeline, giving you a clearer picture of whether an email will actually land in the inbox.

Want to test how your messages will be received? MailTester’s inbox placement testing checks not just delivery, but whether your email’s cryptographic stack meets current standards. That’s how you prevent rejection before it happens.

See how we handle these signals: run a real inbox placement test to see if your email is flagged for weak cryptography or other delivery risks.

Can you still send emails with rsa-sha1 in 2026?

Technically, yes—you can still send emails using rsa-sha1 signatures in 2026, but doing so significantly increases the odds of rejection by major receiving servers. Most modern email providers now enforce strict security policies that exclude SHA-1-based signatures, and even if a message slips through, it’s likely to be marked as low trust or routed to spam. Your sender reputation will degrade over time, especially if you're sending at scale.

Why rsa-sha1 is no longer trusted

SHA-1 was once standard, but it's been cryptographically broken since 2017. Major platforms like Google, Microsoft, and Apple have since banned SHA-1 for email authentication. The Internet Engineering Task Force (IETF) has long deprecated it, and RFC 8314 explicitly discourages its use in modern email security protocols.

Even if your message reaches the inbox, receiving servers may flag it as suspicious. Some legacy systems—especially in government or financial sectors with outdated infrastructure—may still accept rsa-sha1 messages, but they’re increasingly rare. Most email providers now require SHA-256 or stronger signing algorithms for DMARC alignment and domain-based validation.

What happens when you send with outdated cryptography

Every email sent with rsa-sha1 adds to a pattern of poor cryptographic hygiene. Receiving servers analyze sender reputation, and consistent use of obsolete algorithms signals outdated or insecure practices. This affects your long-term deliverability—even if you’re not blocked outright, your messages may be downgraded in priority.

Think of your sender reputation like a credit score. Using weak cryptography is like using an old, unverified identity. You might get past the front door occasionally, but over time, you’re treated with suspicion. Even if your content is relevant, the signal you send about your technical setup hurts perception.

There are no large-scale email platforms that recommend or support SHA-1-based signing in 2026. The industry has moved on. If you’re still using rsa-sha1, now is the time to update your infrastructure. You can verify your sender setup and test deliverability before sending to large lists with MailTester’s inbox placement tester. It’ll show you where your messages land—and whether they survive the security gate.

How to verify your sender’s DKIM configuration before sending?

You can catch DKIM problems early by validating your sender’s configuration in real time. Use MailTester’s API to check individual addresses, verify bulk lists for weak algorithms like a=rsa-sha1, and test delivery across Gmail, Outlook, and Yahoo to ensure your messages land in inboxes—not rejection folders. This proactively prevents deliverability issues caused by outdated or insecure signatures.

Check individual addresses with real-time testing

Let’s start simple. If you’re sending to a single address and suspect a DKIM issue, use MailTester’s real-time verification API to test it instantly. The API checks not just syntax but actual signature behavior, including whether the server accepts a=rsa-sha1 or rejects it due to policy enforcement. It returns precise feedback: valid, invalid, catch-all, or risky—so you know exactly what’s failing.

Bulk validation identifies systemic risks

  • Run a bulk list check across dozens or thousands of addresses to surface patterns in weak DKIM configurations, especially legacy algorithms like a=rsa-sha1.
  • Check multiple senders or domains at once—many organizations use shared infrastructure with mixed signing policies. Bulk verification exposes which domains fail due to insecure or outdated DKIM keys.
  • Use the results to prioritize updates. For example, if 12% of your list fails because of expired or weak signatures, it’s likely not just one email but a configuration issue in your email service provider.

Verify inbox placement before going live

Even correct DKIM doesn’t guarantee inbox delivery. Test your full message path with MailTester’s inbox placement suite, which simulates how your email lands in Gmail, Outlook, and Yahoo. These platforms increasingly reject messages signed with weak algorithms—even if the technical structure is correct—based on internal security policies.

Integrate directly into your workflow

Don’t wait until after sending. Integrate MailTester with Mailchimp, HubSpot, SendGrid, or Klaviyo to validate sender settings before each campaign. The API runs automated checks on every address you send to, catching DKIM misconfigurations before they harm your sender reputation or trigger blacklisting.

Security policies evolve. A signature that worked last year might now break due to updated server rules. That’s why continuous validation matters. Start with 100 free verifications—no expiration—to check your sending system today. The real-time feedback helps you maintain compliance with industry standards like RFC 6376 and avoid rejection due to obsolete crypto.

What should you do if you’re unable to update your DKIM settings?

Receiving servers reject emails signed with a=rsa-sha1 because SHA-1 is no longer considered secure. If you cannot update your DKIM settings directly, confirm with your third-party ESP—such as SendGrid or Amazon SES—whether they enforce SHA-256 signing by default.

Avoid assuming default configurations are safe. Many legacy systems still use older algorithms unless explicitly updated. Regularly monitor bounce reports and header logs for recurring DKIM verification failed or signature algorithm weak errors to catch issues early.

Record these findings and prioritize upgrading your signing stack before deliverability degradation impacts your campaigns. Delaying this step increases the risk of inbox placement drops and blacklisting.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does a=rsa-sha1 mean my email is invalid?

Not necessarily. It means the signature algorithm is outdated and may be rejected by modern servers. The email may still send but likely won’t reach the inbox.

Can a=rsa-sha1 cause permanent blocklisting?

Not directly, but it contributes to poor sender reputation and can trigger DMARC failure, which increases the risk of being blocked.

Is rsa-sha1 still used in email today?

Some legacy systems still use it, but it is no longer supported by major providers like Google, Microsoft, or Apple as of 2024.

How do I know if my DKIM key is using SHA-1?

Check the DKIM-Signature header in your sent email. If 'a=rsa-sha1' appears, your key is using a deprecated algorithm.

Why do some services still allow rsa-sha1?

Some older ESPs or self-hosted systems may not enforce modern standards. This is a risk to deliverability and security.

Is mail verification enough to catch rsa-sha1 issues?

No. Most tools only check syntax and domain configuration. Only platforms like MailTester with deep header inspection can detect weak algorithms.

Can I fix rsa-sha1 at the domain level without re-signing all past emails?

Yes. Re-signing past emails is unnecessary. Focus on updating the current DKIM key and ensuring all new messages use SHA-256.

Which email providers reject rsa-sha1?

Gmail, Outlook, Yahoo, Apple Mail, and most enterprise email platforms now reject messages signed with rsa-sha1.

Does a=rsa-sha1 affect email encryption?

No. This affects DKIM signature validation, not encryption. Encryption is handled separately (e.g., TLS).

What is the best alternative to rsa-sha1?

Use 'a=rsa-sha256' or 'a=rsa-sha512' with a properly configured DKIM key. SHA-256 is the industry standard.

How often should I audit my DKIM settings?

At least once per quarter. Include header inspection and signature algorithm checks to prevent security drift.

Is there an open-source tool to test DKIM algorithm strength?

Yes — tools like dkimvalidator.org or MxToolbox can check header syntax, but fewer provide deep analysis of algorithm strength.