A widely adopted method for email authentication is DomainKeys Identified Mail (DKIM) which allows email recipients to verify that the sender’s domain has authorized the email and that it hasn’t been tampered with during transit. While RSA signatures have been commonly used in DKIM, they come with certain limitations. In this blog, we will explore the advantages of DKIM ED25519 signatures over RSA signatures and guide you through the process of configuring DKIM ED25519 signatures.

The Shortcomings of RSA Signatures

RSA (Rivest-Shamir-Adleman) is a widely used encryption algorithm that has served as the foundation for DKIM signatures for many years. However, RSA signatures have some drawbacks that have led to the adoption of alternative algorithms like ED25519. Here are a few shortcomings of RSA signatures:

Vulnerability to Cryptographic Attacks: RSA signatures are susceptible to certain cryptographic attacks, such as the factoring problem. As computational power increases, the time required to crack RSA keys decreases, making them less secure over time.

Performance Overhead: RSA signatures involve complex mathematical calculations, leading to increased processing time and resource consumption. This can be a significant concern in high-volume email environments.

Key Size and Complexity: RSA keys require larger sizes to provide a similar level of security as smaller keys in other algorithms. This increases the complexity and storage requirements for maintaining RSA keys.

The Advantages of DKIM ED25519 Signatures

To address the limitations of RSA signatures, DKIM has introduced support for ED25519 signatures. The ED25519 algorithm is based on elliptic curve cryptography and offers several benefits:

Enhanced Security

ED25519 is considered highly secure and resistant to known cryptographic attacks. It provides a similar level of security as RSA with shorter key lengths, reducing the risk of key compromise.

Improved Performance

ED25519 signatures offer superior performance compared to RSA signatures. The elliptic curve computations involved in generating and verifying ED25519 signatures are significantly faster, resulting in reduced processing time and lower resource requirements.

Smaller Key Sizes

ED25519 keys are shorter (256 bits) than RSA keys while offering the same level of security as 4096 bits RSA signature keys. This simplifies key management and reduces storage requirements, making it easier to handle large-scale deployments.

Better Future Proofing

The security of RSA signatures depends on the key size, and larger keys are needed as computational power increases. In contrast, ED25519 is expected to maintain its security strength even as technology advances, ensuring long-term viability.

Configuring DKIM ED25519 Signatures

To configure DKIM ED25519 signatures, follow these steps:

1. Generate DKIM Keys

Use a DKIM key generation tool that supports ED25519 signatures to generate a private key and a corresponding public key.

2. Publish the Public Key

Publish the public key in your domain’s DNS records as a TXT record under the specified DKIM selector. This allows email recipients to verify the authenticity of emails sent from your domain.

3. Configure your Mail Server

Update your mail server’s DKIM configuration to use the generated private key for signing outgoing emails. Refer to your mail server’s documentation for instructions on how to update DKIM settings.

4. Test and Monitor

After configuration, send test emails to verify that DKIM signatures are correctly applied and validated by recipient mail servers. Monitor the DKIM signature status to ensure successful deployment.

Publishing ED25519 DKIM key in the DNS

While publishing your ED25519 DKIM keys, you need to consider the following syntax:

k=ed25519 (instead of the usual RSA in full caps)

p=(must contain BASE64 encoded key)

Note: DKIM key syntax is case sensitive

Best Practices for Using DKIM ED25519 and RSA Signatures

While DKIM ED25519 signatures offer numerous advantages over RSA signatures, it is important to consider backward compatibility with systems that may not support the newer algorithm. To ensure maximum compatibility and reliability, it is recommended to implement a dual DKIM signature approach. This approach involves signing emails with both an ED25519 signature and an RSA signature. Here’s why it’s beneficial:

Compatibility: By including both ED25519 and RSA signatures, you ensure compatibility with a broader range of mail servers and email clients. Some older systems or third-party services might not yet support or validate ED25519 signatures. Including an RSA signature allows these systems to still validate the DKIM signature and prevent false positives or rejections.
Testing Phase: Implementing a dual DKIM signature approach during the testing phase allows you to gradually move towards full adoption of ED25519 signatures. It provides a safety net and allows you to monitor the acceptance and validation rates of ED25519 signatures by different receivers.
Future-Proofing: Including both ED25519 and RSA signatures future-proofs your DKIM configuration. As more systems and providers adopt ED25519 support, you can gradually phase out the RSA signature while maintaining compatibility with legacy systems. This ensures that your email authentication mechanism remains robust and effective as the industry evolves.

Conclusion

n conclusion, implementing DKIM ED25519 signatures provides a more secure and efficient solution for email authentication. However, considering backward compatibility and the varying levels of support for ED25519 across different systems, adopting a dual signature approach is recommended. We must remember to follow best practices for key management and stay updated with industry trends to optimize our DKIM implementation.

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

How to Configure DKIM ED25519 Signatures?