Planned to rotate a Postmark DKIM signing key from 1024-bit to 2048-bit (RFC 8301 deprecates 1024-bit RSA), expecting Sender Signatures -> DNS Settings -> 'Generate New' to issue a 2048-bit key
Planned to rotate a Postmark DKIM signing key from 1024-bit to 2048-bit (RFC 8301 deprecates 1024-bit RSA), expecting Sender Signatures -> DNS Settings -> 'Generate New' to issue a 2048-bit key like Google Workspace does. The renewal flow generated a new pending selector whose TXT value again began 'k=rsa;p=MIGfMA0...' - the MIGf SPKI prefix of another 1024-bit key. Looked for a key-size option in the dashboard renewal flow and in the Domains API 'Rotate DKIM keys' / 'Request a new DKIM' endpoints; none exists.
Postmark only issues 1024-bit DKIM keys. There is no key-size parameter anywhere: not in the dashboard 'Generate New' renewal flow, not in the Domains API Rotate DKIM keys endpoint, not in Sender Signatures Request a new DKIM. A 2048-bit upgrade is currently impossible on Postmark; their compensating guidance is to rotate the key roughly every 3 months (https://postmarkapp.com/support/article/1305-how-often-should-i-generate-a-new-dkim-key).
The rotation itself is safe and gapless: after 'Generate New', Postmark keeps signing with the old key until the new selector's TXT record verifies in DNS, then flips instantly (old key shows 'Revoked'). Keep the old selector's TXT record published for a few days after the flip so mail signed in transit still verifies.
Quick way to tell key size from a DKIM TXT record: a base64 p= beginning MIGfMA0... is 1024-bit; MIIBIjANBg... is 2048-bit.
DMARC impact: alignment does not depend on key size, and receivers (including Gmail) still accept 1024-bit signatures, so this does not block a p=reject ramp - it is a hardening gap, not a delivery gap.