Why RSA-SHA1 Is No Longer Secure

What does it mean when you hear 'RSA-SHA1 is broken'?

You’re sending email. The recipient’s server checks the DKIM signature. It passes. But what if that signature was forged—because the math behind it was outdated?

RSA-SHA1 was the default algorithm for DKIM signing for years. But cryptographic advances have made it unreliable. SHA-1’s ability to resist collisions—the same hash for different inputs—was broken in 2017. Once that happens, digital signatures lose their integrity. If an attacker can produce two different messages with the same hash, they can forge a valid-looking DKIM signature. That undermines the trust chain email relies on.

Why does this matter? Because your sender reputation, inbox placement, and overall deliverability depend on cryptographic trust. Using RSA-SHA1 weakens that trust, even if the email appears legitimate.

Key takeaways

Digital signatures using SHA-1 are vulnerable because collision attacks can forge valid signatures.
RSA-SHA1 is no longer considered secure for DKIM due to known weaknesses in the underlying hash function.
Modern DKIM implementations should use SHA-256 or higher to maintain cryptographic integrity and deliverability trust.

How does RSA-SHA1 actually work in DKIM signing?

When you send an email, your server creates a digital signature using your private key and a SHA-1 hash of the message body and selected headers. This signature is added as a DKIM-Signature header. Recipients verify it by fetching your public key from DNS, rehashing the same parts of the email with SHA-1, and checking if the signature matches—proving the email wasn’t altered and came from you.

The Step-by-Step Process

Hash the email content. Your server computes a SHA-1 hash of the email’s headers (excluding DKIM-Signature) and body. This unique fingerprint represents the exact content sent.
Sign the hash with your private key. Using the RSA algorithm, your server encrypts the SHA-1 hash with your private key. This creates the digital signature, which is specific to your key and the message.
Add the signature to the email. The result is embedded in a DKIM-Signature header field—part of the email’s standard metadata—so receivers can find and use it.
Receive and retrieve the public key. The recipient's server extracts the DKIM-Signature header, finds your domain, and looks up your public key in DNS via a TXT record.
Recompute the hash and verify. The recipient's server recalculates the SHA-1 hash of the incoming email’s content, then decrypts the signature using your public key. If both hashes match, the email is authentic and unaltered.

Why This Process Is No Longer Trustworthy

SHA-1's theoretical strength has eroded. In 2017, Google and CWI Amsterdam demonstrated a practical collision attack using a cluster of servers to find two different inputs that produce the same SHA-1 output. This means a malicious actor could create two emails—one legitimate, one forged—that share the same hash, tricking a DKIM verifier into accepting a tampered email as valid. The same vulnerability exists in any system relying on SHA-1 for integrity verification.

The 5 steps described in “The Step-by-Step Process”, in order.

While RSA-SHA1 still technically works in DKIM, it no longer provides the security guarantee it once did. Modern standards now require stronger hash functions like SHA-256. The IETF (Internet Engineering Task Force), which oversees email protocols, has deprecated SHA-1 in cryptographic contexts since 2011.

For email senders relying on DKIM, this means evolving beyond legacy methods. You can verify your own DKIM configurations and domain setup using DKIM testing tools and ensure your provider supports SHA-256 signing. For teams managing large email lists, catching invalid or compromised domains early reduces deliverability risk. Bulk list verification can help identify misconfigurations before they impact reputation.

Why is SHA-1 no longer trustworthy for email authentication?

SHA-1 is no longer trusted because in 2017, Google demonstrated a practical collision attack—SHAttered—proving two different messages could produce the same hash. This means attackers could forge a valid DKIM signature for a malicious email that appears indistinguishable from a legitimate one. Once compromised, DKIM’s ability to verify message integrity and sender authenticity collapses, leaving email systems vulnerable to undetected tampering.

How SHA-1’s weakness breaks DKIM

DKIM relies on cryptographic integrity: if the hash of a signed email doesn’t match on receipt, the message is rejected. But SHA-1’s collision vulnerability means an attacker can create two different emails with the same hash. They could sign the benign version, then substitute it with a malicious one—still passing the DKIM check.

Let’s say you sign a newsletter using SHA-1. An attacker finds a way to generate an identical hash for a phishing message. When that message arrives with your DKIM signature, it’s accepted as authentic. The system checks the signature, sees a match, and delivers the email—no red flags. This is exactly how the SHAttered attack exposed a fatal flaw in relying on SHA-1.

Why the shift matters for email deliverability

Modern email providers such as Gmail and Outlook now reject messages using outdated algorithms like SHA-1. Using SHA-1 signals poor infrastructure hygiene, even if the message isn't malicious. This risks your email’s reputation and lowers inbox placement.

You can’t just rely on email verification alone to prevent this. A valid address might still be used maliciously if the signing algorithm is weak. That’s why it’s critical to ensure your email infrastructure uses modern standards—like SHA-256 for DKIM—and regularly audit your signing configuration.

Check your DKIM setup using tools that simulate real-world delivery. For instance, MailTester’s inbox placement test checks how your emails land across major providers, including whether outdated signatures trigger rejection.

What happens when a receiving server detects a weak signature?

When a receiving server detects a message signed with RSA-SHA1, it typically treats the signature as insecure. Major providers like Gmail, Outlook, and Yahoo now flag or reject such messages, often marking them as spam or isolating them for further scrutiny. This directly harms your sender reputation and reduces inbox placement—especially if you're sending at scale.

Reputation risks from outdated DKIM signatures

Modern email security systems don’t just ignore weak signatures—they actively penalize them. A message using RSA-SHA1 fails to meet current cryptographic standards, which means receivers see it as a red flag. While there’s no blanket policy that blocks all RSA-SHA1 messages outright, many filtering engines now apply additional scrutiny, increasing the chance of a low spam score or outright rejection. This is especially likely for bulk senders with high volume or poor engagement rates.

Let’s be clear: RSA-SHA1 is no longer considered fit for purpose in security-sensitive environments. As documented in NIST’s 2011 guidelines (though not retired until later), SHA-1 was deemed cryptographically weak due to collision vulnerabilities that can be exploited. Today, the consensus in the email security community is that any DKIM signature using SHA-1 increases risk, even if it technically “validates.”

For example, a 2020 study by the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG) found that messages with outdated crypto signatures were more likely to be diverted to spam folders—even when all other authentication checks passed. This isn’t theory. It’s how systems respond when they detect a known weakness, even if the message itself isn’t malicious.

And it isn’t just about spam filtering. Poor cryptographic practices can hurt your long-term deliverability. If your sending infrastructure continues to rely on RSA-SHA1, you’re not just slowing down progress—you’re actively weakening your sender reputation. As more servers adopt stricter validation, your ability to land in inboxes will diminish.

How to fix this and future-proof your setup

Switching to a stronger signature like RSA-SHA256 or ECDSA with SHA-256 is the only sustainable fix. Most modern email platforms and infrastructure tools now support these standards. If you’re managing DKIM keys, ensure they’re generated using modern algorithms and stored securely.

Before rolling out changes, verify that your domain’s DKIM records are properly configured. You can test inbox placement with tools like MailTester’s inbox tester, which simulates real-world delivery across major providers. You can also use their email checker to validate individual addresses or their bulk verification tool to clean your list ahead of sending—ensuring you're not sending to outdated or compromised systems that might amplify signature issues.

What are the accepted modern alternatives for DKIM signing?

Upgrade from RSA-SHA1 to RSA-SHA256 or ECDSA-SHA256. Both are cryptographically secure, widely supported by modern email providers, and align with current best practices. RSA-SHA256 offers stronger hashing; ECDSA-SHA256 delivers equivalent security with smaller keys and faster processing.

RSA-SHA256: The standard upgrade path

Replaces RSA-SHA1 with a more robust hash function, preventing known collision attacks.
Still uses RSA key pairs but with SHA-256 instead of the deprecated SHA-1.
Required by modern email security standards, including DMARC, and supported by all major mail providers.
Recommended for organizations prioritizing compatibility and stability across the email ecosystem.

ECDSA-SHA256: Performance and efficiency gains

Uses elliptic curve cryptography, achieving the same security level as RSA with much smaller key sizes.
Reduces computational overhead, speeding up signature creation and verification—ideal for high-volume senders.
Adopted by leading email services, including Gmail, Outlook, and Yahoo, and is included in industry-standard RFCs.
Let’s be clear: it’s not just “faster”—it’s the future of efficient, secure email authentication.

Both RSA-SHA256 and ECDSA-SHA256 are endorsed by the IETF, the standards body behind email security protocols. You can review the details in the official specification for DKIM, which outlines the current recommended algorithms.

While RSA-SHA1 is still technically functional in some legacy setups, relying on it increases the risk of domain compromise and reduces deliverability. Modern systems routinely reject or flag messages signed with weak algorithms.

If you're validating your email infrastructure, tools like our email checker help ensure your sending infrastructure aligns with current standards—before you hit the inbox.

How do I check if my domain is still using RSA-SHA1?

Fetch a signed email from your domain and check the DKIM-Signature header. Look for the a=rsa-sha1 tag—this means your domain still uses the outdated algorithm. You can also verify your DKIM DNS record using a public tool like MxToolbox or dnschecker.org to confirm what signing method is in use.

Step-by-step: how to verify your DKIM signing algorithm

Retrieve a signed email from your domain—ideally one sent within the past month. Check your mail server logs, or use a test email sent to yourself from a verified address.
Inspect the DKIM-Signature header in the email’s raw source. Look for the a= tag. If it says rsa-sha1, your domain is still using a deprecated algorithm.
Check your DNS TXT record using a public lookup tool like MxToolbox or dnschecker.org. Paste your domain’s DKIM selector (e.g., default._domainkey.yourdomain.com) to see if the Algorithm=rsa-sha1 value appears in the TXT record.
Review the results. If the algorithm is rsa-sha1, it's time to update your DKIM keys. Modern standards require rsa-sha256 or newer.
Update your DKIM configuration in your email provider’s settings. Most platforms now default to rsa-sha256, but confirm this if you're self-hosting, using SendGrid, Mailgun, or similar.

Why this matters

RSA-SHA1 is no longer trusted—major mail providers like Google and Microsoft treat messages signed with it as low trust or high risk. This can hurt deliverability. The IETF formally deprecated SHA-1 in 2020 in RFC 8301, and standards bodies now require stronger algorithms.

If you’re still using RSA-SHA1, it’s not just outdated—it’s a security risk. Even a single bad signature can trigger filters or cause mislabeling as spam. Fixing it takes minutes, but it prevents long-term deliverability issues.

For ongoing verification, test your domain’s mail setup with tools like inbox placement testing or real-time email validation. These help confirm your domain’s health across major inboxes and avoid silent bounces.

What should I do to upgrade my DKIM setup?

You should generate a new DKIM key pair using RSA-SHA256 or ECDSA-SHA256, update your DNS TXT record with the new public key and ensure the 'a=' tag reflects the algorithm, then re-sign outgoing messages and monitor delivery logs for anomalies. This is the only way to stay compliant with current email security standards and maintain sender reputation.

Step-by-step upgrade process

Generate a new DKIM key pair using RSA-SHA256 or ECDSA-SHA256. RSA-SHA256 is widely supported and interoperable; ECDSA-SHA256 offers stronger security with smaller key sizes. Avoid RSA-SHA1 entirely—no major email provider trusts it anymore. The DKIM RFC explicitly discourages SHA1 use for new implementations.
Update your DNS TXT record with the new public key. Make sure the a= tag in the DKIM record matches the algorithm used—a=rsa-sha256 or a=ecdsa-sha256. Misalignment breaks verification and can trigger spam filters.
Re-sign outgoing mail using the new private key. This affects all outbound email from your domain. If you're using a third-party ESP (like SendGrid or Mailchimp), verify their DKIM settings and ensure they support the new algorithm.
Monitor delivery logs and engagement metrics for a 48–72 hour window after rollout. Watch for unexpected bounce spikes, increased spam reports, or reduced inbox placement. Even minor configuration errors can degrade deliverability. Tools like inbox placement testing can help validate real-world deliverability before bulk sends.

Why this matters now

Digital signatures based on SHA1 are no longer trusted by major ISPs (including Google, Microsoft, Yahoo). Even if your old DKIM signature passes technically, many providers will treat it as suspicious or low-trust. This affects spam filtering, reputation scoring, and inbox placement.

Recent changes in email security policies—such as those from DMARC.org and major inbox providers—have made RSA-SHA1 signing effectively obsolete. Sticking with it increases the risk of messages being blocked or flagged, especially from domains with weak reputations.

Upgrading doesn't require overhauling your entire email stack. Just update the key, correct the DNS record, and re-sign. The process takes minutes, and the long-term benefit is stronger trust and higher delivery reliability.

What are the real-world consequences of not upgrading?

Domains still using RSA-SHA1 for DKIM signing expose themselves to rejection, suspicion, and reputation damage. Modern email systems treat this outdated method as a red flag, often blocking or downgrading messages—even from clean, legitimate senders—because it's no longer cryptographically reliable. This isn't theoretical: major providers actively enforce stronger signing standards.

How filtering systems react to weak DKIM signatures

Advanced filtering systems like those used by Gmail, Outlook, and other major providers now flag emails with RSA-SHA1 signatures as potentially suspicious. These systems evaluate the entire authentication chain, and a known-weak signature undermines trust in the sender’s identity. As a result, your message may land in spam, be throttled, or rejected outright.

Even if your content is well-formatted, your list is permission-based, and your sending practices are clean, weak DKIM can still trigger automated blocks. This happens because filters correlate the signing method with known abuse patterns—especially high-volume sending from domains with outdated security. The system assumes risk, not intent.

There’s no “just send anyway” workaround. When a receiving server detects a DKIM signature using SHA-1, it may treat it as a failure or downgrade the message’s score—leading to poor inbox placement or outright rejection. This is especially true for domains with a history of weak configurations or poor sending hygiene.

Reputation cost: a silent killer

Your sender reputation isn’t just about spam complaints or bounces. It’s built on trust signals across multiple domains and technical practices. Using an outdated signature method like RSA-SHA1 sends a strong signal that you’re not keeping up with email security standards.

Even a single message rejected due to weak authentication can start a downward spiral—some providers track signing quality as part of their reputation model. Once you’re flagged, recovery can take weeks or months, especially if multiple domains or IPs are involved.

Let’s be clear: upgrading isn’t about compliance alone. It’s about maintaining deliverability in a world where email hygiene is now a hard requirement. You can’t afford to ignore it.

Check your DKIM setup and verify your email addresses in advance with tools designed for accuracy. Use MailTester’s email checker to validate individual addresses before sending, or bulk verify your list to catch invalid or problematic accounts early. Make sure your infrastructure follows modern standards—like RSA-SHA256 or ECDSA—before you send.

For deeper validation of authentication health, see RFC 8659, which formally deprecates SHA-1 in DKIM. The shift is well underway. The question isn’t whether to upgrade—it’s when.

Can you test if your DKIM signature is still vulnerable?

You can test your DKIM signature's security by sending real emails through tools that validate both the signing algorithm and the full signature integrity in practice. MailTester’s inbox-placement testing checks whether your DKIM signature uses weak algorithms like RSA-SHA1, confirming if your domain is still exposed to known vulnerabilities. This real-world validation is more reliable than static checks.

Why static checks aren’t enough

Just because your domain has a DKIM record doesn’t mean it’s secure. Algorithms like RSA-SHA1 are outdated and have known cryptographic weaknesses that allow attackers to forge signatures. Even if your setup looks correct on paper, a real email sent through a live mailbox can expose these flaws. Static DNS checks won't catch this—only real delivery testing will.

Test your DKIM in practice

Tools that simulate actual inbox delivery, like MailTester’s inbox-placement tester, validate how your DKIM signature behaves under real conditions. This includes checking whether the signature algorithm is still considered secure by modern standards—such as RSA-SHA256 or ECDSA—rather than relying on legacy ones like RSA-SHA1.

MailTester’s inbox-tester integrates DKIM validation into every test. It checks not just the presence of a signature, but also whether the algorithm used is currently recommended. The RFC 8301 standard explicitly deprecates RSA-SHA1 for DKIM, making this validation essential for maintaining trust.

For ongoing protection, integrate MailTester’s real-time API into your sending workflow. You can validate new or updated domains before sending mail, ensuring that no email leaves your system with a vulnerable signature. This prevents accidental exposure to spam filters or email providers that now reject RSA-SHA1 signatures outright.

Check your current DKIM setup: it may look fine in DNS, but unless tested in a real email environment, you won’t know if you’re still vulnerable. Use real email delivery tests, not just DNS records.

Learn more about modern authentication standards: RFC 8301 and DNSSEC.net provide reference material on secure email practices.

Final takeaway: Security isn’t optional — it’s foundational.

RSA-SHA1 was adequate in the past, but cryptographic advances have rendered it obsolete. What was trusted then is now vulnerable to exploitation, compromising both message integrity and sender reputation.

Modern email deliverability depends on up-to-date authentication. Switching from RSA-SHA1 to RSA-SHA256 or ECDSA-SHA256 is no longer a technical preference — it’s required for inbox placement and sustained trust.

Regular verification is essential. Use MailTester to test your DKIM signature, confirm your domain’s configuration, and ensure your emails meet current security standards.

Sources

Roughly one in six legitimate commercial emails (16.5%) never reaches the inbox globally — 6.7% is filtered to spam and 9.8% disappears without a bounce. — Validity 2025 Email Deliverability Benchmark Report (2025)
Benchmark testing of 15 major email service providers found about 10.5% of legitimate emails land in the spam folder and a further 6.4% go undelivered. — EmailTooltester deliverability benchmark (via WarmForge) (2026)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does using RSA-SHA1 mean my emails will be blocked?

Not automatically, but your email is more likely to be flagged or rejected by recipients with strong spam filters. It harms sender reputation and inbox placement.

How can I find out if my email service provider supports SHA-256?

Check your provider’s documentation or support portal. Major platforms like SendGrid, Mailchimp, and HubSpot support RSA-SHA256; verify your DKIM record to confirm.

Is ECDSA better than RSA-SHA256 for DKIM?

ECDSA offers equivalent security with shorter keys and faster signing. However, RSA-SHA256 remains widely supported and is sufficient for most use cases.

Can I keep RSA-SHA1 on some domains while upgrading others?

Yes, but it increases overall risk. It's better to standardize on secure algorithms across all sending domains.

How long does it take to implement a DKIM algorithm change?

The DNS change takes minutes. Full rollout depends on how quickly your email service re-signs messages and how long existing recipients cache your records.

Do I need to inform recipients when I update DKIM?

No. DKIM is a technical signature; recipients don't need to be notified. The change happens silently behind the scenes.

What happens if a recipient doesn’t support RSA-SHA256?

All modern email systems support it. Legacy systems are so rare that they don’t affect deliverability for legitimate senders.

Can DKIM failures cause deliverability issues even with good content?

Yes. DKIM failure is one of the top technical reasons for email rejection, regardless of content. Fixing it improves inbox placement.

How does MailTester help with DKIM validation?

MailTester’s inbox-placement testing checks DKIM signatures in real email inboxes and confirms the signing algorithm is secure and valid.

Is there a free way to test my DKIM signature?

Yes. Use MailTester’s free plan to verify 100 email addresses and test inbox placement, including DKIM validation, with no expiration on credits.

Can MailTester detect if an email was forged?

Not directly, but by validating DKIM and SPF alignment and checking sender reputation, it helps identify if a message is likely to be fraudulent.

Do I need to verify all my domains, even old ones?

Yes. Even dormant domains can be exploited if they use weak signatures. Regular audit and cleanup improve overall security posture.