Another use case for multiple DKIM signatures is as a blanket verification mechanism.
Yahoo's complaint feedback loop normally expects ownership verification through a DNS TXT insert. For entities with a large number of sending domains (like a CRM platform), Yahoo accepts signatures from a previously agreed-upon domain/selector pair in lieu of a DNS insert. - Chris On Wed, Nov 4, 2026 at 4:09 PM Randolf Richardson, Postmaster via mailop < [email protected]> wrote: > > On 04.11.26 11:21, A. Schulze via mailop wrote: > > >accedently I found a message having 8 DKIM signatures. My DKIM > > >verifier (OpenDKIM) wrote a log "ignoring 2 signatures". Challenge > > >accepted! I also found "ignoring 53 signatures"! *) > > > > > >The number of messages having *many* DKIM signatures is very low. But > > >the exist. > > >And for that reason it's good to have a limit like this: > > > > https://manpages.debian.org/trixie/opendkim/opendkim.conf.5.en.html#MaximumSignaturesToVerify > > > > >This is also mentioned in RFC 6376, Section 4.2 > > > > > >>To limit potential denial-of-service attacks, Verifiers MAY limit the > total > > >>number of signatures they will attempt to verify > > > > > >Have a minute to check that your DKIM validation implementation have > > >limits implemtent and activated ... > > > > I just want to point out that the default for this is according to > opendkim > > manpage "3" which I believe should be enough most of the time. > > > > Also, the same doc indicates that signature for domain in From: is > always > > verified. > > To add to this good information (above) is that two common reasons > for having multiple DKIM keys is: > > 1. to support re-signing existing DKIM keys in parallel with the old > ones (usually only for a short during) > > 2. to support newer ED-signed DKIM keys in parallel with RSA-signed > DKIM keys so as not to exclude older systems that don't support these > newer algorithms > > RSA 2048-bit DKIM keys are the most common, although many systems are > still using only RSA 1024-bit DKIM keys (these DKIM keys should be > upgraded to at least 2048-bit as soon as possible). > > ED25519 and ED448 keys are newer, but not as widely supported, > although I hope this will cease to be a problem soon. While ED25519 > has the smallest key size, ED448 has a slightly larger key size with > the benefit of better security (both are a lot smaller than the RSA > keys, which is also much nicer for DNS record maintenance). > > I suspect that as more mail systems begin to transition to supporting > ED-signed DKIM keys that the presence of multiple DKIM keys will also > become more common as long as there is a significant quantity of mail > SMTP servers that only support checking RSA-signed DKIM keys. > > The following Linux script I wrote generates all these keys, just in > case anyone is interested in seeing the differences, and also > possibly deploying these: > > #!/bin/bash > # DKIM key generation script by Randolf Richardson > # in Beautiful British Columbia, Canada > export DATE=`date +'%Y%m%d'` > > # RSA (modern OpenSSL versions default to 2048-bit) > echo openssl genpkey -algorithm rsa -out dkim_private_${DATE}rsa.pem > echo openssl pkey -in dkim_private_${DATE}rsa.pem -pubout -out > dkim_public_${DATE}rsa.pem > > # ED25519 > echo openssl genpkey -algorithm ed25519 -out > dkim_private_${DATE}ed25519.pem > echo openssl pkey -in dkim_private_${DATE}ed25519.pem -pubout -out > dkim_public_${DATE}ed25519.pem > > # ED448 > echo openssl genpkey -algorithm ed448 -out dkim_private_${DATE}ed448.pem > echo openssl pkey -in dkim_private_${DATE}ed448.pem -pubout -out > dkim_public_${DATE}ed448.pem > > -- > Postmaster - [email protected] > Randolf Richardson, CNA - [email protected] > Inter-Corporate Computer & Network Services, Inc. > Vancouver, Beautiful British Columbia, Canada > https://www.inter-corporate.com/ > > > _______________________________________________ > mailop mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
