---
"@context": https://schema.org
"@type": TechArticle
"@id": https://www.twilio.com/docs/sendgrid/ui/account-and-settings/migrating-to-2048-bit-domainkeys-identified-mail-dkim#article
headline: Migrating to 2048 Bit DomainKeys Identified Mail (DKIM)
description: Migrate your Twilio SendGrid domain authentication to 2048-bit DomainKeys Identified Mail (DKIM) keys for stronger email security and protection.
url: https://www.twilio.com/docs/sendgrid/ui/account-and-settings/migrating-to-2048-bit-domainkeys-identified-mail-dkim
inLanguage: en
dateModified: 2026-07-23T16:57:51.000Z
author:
  "@type": Organization
  name: Twilio Developer Education Team
publisher:
  "@type": Organization
  name: Twilio
---

# Migrating to 2048 Bit DomainKeys Identified Mail (DKIM)

Twilio SendGrid uses [2048-bit DomainKeys Identified Mail (DKIM) keys](https://www.twilio.com/en-us/blog/insights/2048-bit-dkim-keys) to provide stronger security and protection. Existing domain authentication configurations don't change automatically. To enhance the security of your existing setup, follow this guide.

If you created your first domain authentication after May 2021, you already have a 2048 DKIM key.

## Check your DKIM key length

To determine whether you have 1024-bit or 2048-bit DKIM keys, use the [DKIM Key Checker tool](https://protodave.com/tools/dkim-key-checker/). The tool asks for the selector and domain. If the customer's DKIM key was at `s1._domainkey.example.com`, then you would enter "s1" in the selector field and "example.com" in the domain field.

## Migrate to 2048-bit DKIM keys

To migrate to 2048-bit DKIM keys, follow these steps:

1. Log into your SendGrid account and navigate to **Settings.**
2. Select **Sender Authentication** and then click **Authenticate Your Domain**.
3. Continue through the domain authentication process. When you get to the second page, you will need to use a [custom selector](/docs/sendgrid/ui/account-and-settings/how-to-set-up-domain-authentication#use-a-custom-dkim-selector) that differs from the default "s1" that SendGrid uses under the advanced settings. You should use a unique value (eg. 'abc').
4. Delete the old domain authentication once you have verified the new one.

For more information about DKIM records, go to the [DKIM Records Explained](/docs/sendgrid/ui/account-and-settings/dkim-records) page.