ivan
  • ivan
  • 100% (Exalted)
  • Administration Topic Starter
11 years ago
In current EA DKIM Plugin  for Exchange Server and IIS SMTP service,
The DKIM manager generates 1024 key-length key pair automatically, it is recommended.

Anything shorter than 1024 key pair and your risk having the key cracked and your mail fraudulently signed.
A number of ISPs (including Gmail) have declared that they are not accepting keys that are 512-bit or less now.

About 2048 key-length DKIM key pair:
Because EA DKIM plugin allows you use customized key pair and you can use 2048 length key pair, but we don't recommend that.

First of all, the public key of 2048 is very long, it exceeds most DNS server text record limit (255).
Secondly, to sign DKIM with 2048 key pair, it takes more CPU usage and the performance is low.

So we always recommend that you generate the DKIM key pair by DKIM manager automatically.
ivan
  • ivan
  • 100% (Exalted)
  • Administration Topic Starter
11 years ago
Although we don't suggest that you use 2048 key pair, but I would like to introduce how to generate 2048 key pair manually

Generate 2048 key pair manually:

First of all, we need to generate a certificate which contains public key/private key. We can use MakeCert.exe (.NET Framework Tools) to generate 2048 certificate like this:

makecert -pe -n "CN=mydomainkeys" -ss my -sr LocalMachine -a sha1 -sky signature -r -len 2048


Then you can check the certificate like this:
Windows Start Menu->input:
MMC

press enter.

MMC->File Menu->Add/Remove Span-in
Add->Choose "Certificates"-> Computer Account->Local Machine->Finish->Close.

Then you should find the certificate at
"Certificates(Local Computer)->Personal->Certificates"

Right click your certificate->Export->"Yes, export the private key"->input password->save it to *.pfx file.

Then you can use above 2048 certificate in DKIM manager.

EXPLORE TUTORIALS

© All Rights Reserved, AIFEI Software Limited & AdminSystem Software Limited.