dkim fail: public key doen't seems to be valid

Question

I created a public/private rsa key pair with Puttygen. I added the following record to dns but dkim fails. It seems there is some problems with my public key. I checked it with https://dkimcore.org/c/keycheck and found that it is not valid.

v=DKIM1; k=rsa; h=sha256; p=AAAAB3NzaC1yc2EAAAABJQAAAQEArv5BxLaIE0HYkr1RSIqhAUUZ3OPiV81e8d0Q7Iv2jIQ9LCxnw831HteCwMFzry352dW2UfbmjVMesNOiyZWrE2oHYCG/hQ6ocl5KIY/cNrymZYkzFgnG/HeQBU+YZWkRyT7tNzG6IhgFBs7BZdO1iyEJNaAjsdXZJuv7H2Z4r5aDk8n1A0bzfYGhiIX4uSyUbV6T5njsfBX7Un0IBvf/nbEj6NJ+idF0puoz0gWffRWu1zoJfFs8ddjHSGsp4bKQjsm6msAvc7LZ6csmNec1G9UdUAzd+rxETaRIew7p3E6PiPbTfGuLr283V+SZMMume6bgyK3Bg7/bKv80vD71mw==

Is there something wrong with my syntax?

Answer 1

Yes. The key itself must be packaged in a specific format, and you're using the wrong one.

An RSA keypair isn't just a piece of random text – internally it consists of a few large numbers, and different programs have different ways of encoding those numbers into bytes (serializing them). For example, n might go before e or after it; they might be stored big-endian or little-endian; etc. Some formats have a field indicating the key type itself, some don't.

The text you're trying to use with p= is in SSHv2 format. However, DKIM requires it to be in PKCS#1 "RSAPublicKey" format (aka OpenSSL PEM format), although the DKIM specification later contradicts itself by showing an example in X.509 "SubjectPublicKeyInfo" format, and many implementations indeed accept both.

PuTTYgen can output neither of those public key formats – you will need to use a different tool. It would be best to use the key generation tools that your DKIM signing software provides.

(If your DKIM software doesn't come with any, then the openssl command should do the job – its genrsa and genpkey commands can create a new keypair, then rsa or pkey to extract the public half.)