Ed25519 DKIM support: what it means for email security teams

TL;DR: Only 9 of 19 major mailbox providers validate Ed25519 DKIM signatures, according to Red Sift, while Gmail, Microsoft 365 and Yahoo still fail support and six providers accept weak sub-1024-bit RSA keys, creating a split that can break DMARC and expose forgery risk. Universal rollout is premature until providers enforce minimum key lengths and modern signature support is consistent.

Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “How widely supported are Ed25519 DKIM keys and how many providers still accept weak keys?”.

By the numbers:

• Only 9 out of 19 providers successfully validate Ed25519 DKIM signatures.
• Gmail, Microsoft 365, and Yahoo collectively handle the majority of global email traffic.
• The security algorithm provides approximately 128 bits of security, comparable to RSA-3072.

Key questions

Q: What should email teams do first when DKIM keys are still below 1024 bits?

A: Rotate weak DKIM keys immediately and verify that every sending domain uses at least RSA-2048 before any algorithm migration.

Q: Why does Ed25519 DKIM create delivery risk in the current mailbox ecosystem?

A: Because DKIM validation is only useful when receiving providers recognise the algorithm consistently.

Q: What breaks when mailbox providers accept weak DKIM signatures?

A: Authentication breaks because a forged message can inherit the appearance of a valid domain signature.

Practitioner guidance

• Audit DKIM key lengths across all sending domains Identify every selector still using sub-1024-bit RSA and rotate it to at least RSA-2048 before any broader authentication change.
• Test Ed25519 support by mailbox provider Send controlled test mail through the providers that matter most to your user base and record whether each one returns pass, neutral, perm_fail, or malformed results.
• Treat DMARC as a multi-provider control Review how SPF and DKIM alignment behave when one provider supports the algorithm and another rejects it, then set your rollout sequence from those results.

Bottom line: Ed25519 DKIM support is not yet universal enough for broad production rollout, especially where major mailbox providers still fail validation.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →