Advanced Topics Manual for LISTSERV 17.0

Important: Support for DKIM replaced support for the old Yahoo DomainKeys system, which is now deprecated, beginning with LISTSERV 16.0-2017a.

Most LISTSERV sites already using DomainKeys authentication will find this to be a transparent change when upgrading from an earlier version, with no need to make any adjustment to your current settings.  However, see below.

Important: Sites running older versions of LISTSERV which supported the Yahoo DomainKeys specification will wish to review their existing key pair before upgrading to LISTSERV 16.0-2017a or later, as key lengths which were sufficient for DomainKeys may be too short for DKIM. Per RFC 6376 “DomainKeys Identified Mail (DKIM) Signatures”, Section 3.3.3, “Signers MUST use RSA keys of at least 1024 bits for long-lived keys”, whereas many DomainKeys sites may be using keys of 512 or 768 bits.

In addition, RFC 8301 updates RFC 6376 and states in Section 3.1 that “DKIM supports multiple digital signature algorithms.  Two algorithms are defined by this specification at this time: rsa-sha1 and rsa-sha256.  Signers MUST sign using rsa-sha256.  Verifiers MUST be able to verify using rsa-sha256.  rsa-sha1 MUST NOT be used for signing or verifying.”

Bottom line:  L-Soft strongly recommends that all DKIM keys MUST be 1024 bits or more, and they MUST be SHA-256 (AKA SHA-2) keys.  Keys created with the SHA-1 algorithm are NOT supported by the DKIM specification, and MUST NOT be used.  Key pairs NOT meeting these specifications are used strictly at your own risk.