<![CDATA[I reported an insecure DKIM key to Deutsche Telekom / T-Systems.]]>I reported an insecure DKIM key to Deutsche Telekom / T-Systems. They first asked me to further explain things (not sure why 'Here's your DKIM private key' needs more explanation, but whatever...). Then they told me it's out of scope for their bugbounty.

I guess then there's really no reason not to tell you: They have a 384 bit RSA DKIM key configured at: dkim._domainkey.t-systems.nl

384 bit RSA is... how shall I put it? I think 512 bit is the lowest RSA key size that was ever really used. 384 bit RSA is crackable in a few hours on a modern PC (using cado-nfs). The private key is:
-----BEGIN RSA PRIVATE KEY-----
MIHxAgEAAjEAtTliQYV2Xvx1OGkDyOL799BTFEuobY2dn2AgtiKCQgrh78NVK1JK
j0yRXgNnPpGBAgMBAAECMF0t+TBZUCi8xATSMij7VLTxv5Xi5OIXesNiXOKtYIRP
LkpYfR5PggaMScfbmqSssQIZAMwOhm9d7Y7Qi7I2j1AlYbiqdtqO54T7FQIZAONa
9dJFkC6lM3EPXR+0SZ4dqwwpiM0nvQIYYgz8thi5JK264ohq9sTvnu9yKvUN9I09
AhgfgMYZKcxtujRjkSZtMzUUNLYzzDmJe90CGDKwqcBI0v9ChaR8WHht+/chMdxj
7ez94w==
-----END RSA PRIVATE KEY-----

]]>https://board.circlewithadot.net/topic/4d504187-f61f-40f4-b4b1-f3dd74a4e0d8/i-reported-an-insecure-dkim-key-to-deutsche-telekom-t-systems.RSS for NodeFri, 17 Apr 2026 00:56:27 GMTWed, 15 Apr 2026 07:34:51 GMT60<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 17:42:04 GMT]]>@badkeys i didn't know anything below rsa-1024 even existed!

]]>https://board.circlewithadot.net/post/https://mastodon.calitabby.net/users/crispycat/statuses/116415615781241751https://board.circlewithadot.net/post/https://mastodon.calitabby.net/users/crispycat/statuses/116415615781241751Thu, 16 Apr 2026 17:42:04 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 17:41:20 GMT]]>@stellated @kkarhan @momo @badkeys Bit more discussion in German to be found here: https://borncity.com/blog/2025/02/25/merkwuerdige-vorschriften-bei-der-telekom-fuer-e-mail-versand/

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Bebef/statuses/116415612893272867https://board.circlewithadot.net/post/https://mastodon.social/users/Bebef/statuses/116415612893272867Thu, 16 Apr 2026 17:41:20 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 17:38:14 GMT]]>@stellated @kkarhan @momo @badkeys It works like this: send an email to a Telekom recipient. Mail bounces with

<xxxxx@t-online.de>: host mx03.t-online.de[194.25.134.73] refused to talk to

me: 554 IP=1.2.3.4 - None/bad reputation. Ask your postmaster for help

or to contact tobr@rx.t-online.de for reset. (NOWL)

Send an email to tobr@rx.t-online.de, hilarity ensues.

(They send a reply pointing you to https://postmaster.t-online.de/#t4.1)

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Bebef/statuses/116415600674477867https://board.circlewithadot.net/post/https://mastodon.social/users/Bebef/statuses/116415600674477867Thu, 16 Apr 2026 17:38:14 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 17:24:02 GMT]]>@Bebef @kkarhan @momo @badkeys
Do y'all have any docs on this you could link? Is it a blanket automated check a la DKIM and SPF or is it something that's reviewed when appealing an anti-spam listing? My search queries aren't turning up much.

]]>https://board.circlewithadot.net/post/https://mastodon.sdf.org/users/stellated/statuses/116415544831718977https://board.circlewithadot.net/post/https://mastodon.sdf.org/users/stellated/statuses/116415544831718977Thu, 16 Apr 2026 17:24:02 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 14:45:01 GMT]]>@j_r
War bei mir ähnlich. Wer seinen Mailkram dann bei der Telekom hatte, hatte halt Pech. Zwischendrin hatte ich deren ASN im Spamfilter geblockt, weil ja, dann halt auch in beide Richtungen. Dann schlug aber der WAF Alarm und da blieb mir keine Wahl mehr... ich hab aber dann wohl beim Support-Lotto das falsche Ticket, gezogen.

(WAF= Wife Acceptance Factor)
@bekopharm

]]>https://board.circlewithadot.net/post/https://social.linux.pizza/users/momo/statuses/116414919553994446https://board.circlewithadot.net/post/https://social.linux.pizza/users/momo/statuses/116414919553994446Thu, 16 Apr 2026 14:45:01 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 14:38:24 GMT]]>@momo @bekopharm das dreisteste ist es hängt scheinbar stark davon ab welchen Support Mitarbeiter man erreicht. Hab Jahre lang damit gelebt einfach keine E-Mails an t-online senden zu können. Wurde irgendwann dann aber doch zu nervig und ich habe sie nochmal kontaktiert. Dann haben sie ohne große Nachfrage einfach meine IP freigeschaltet 🤷

]]>https://board.circlewithadot.net/post/https://social.jugendhacker.de/users/j_r/statuses/01KPBBN6FPFY6K6RZVMW3S0DYHhttps://board.circlewithadot.net/post/https://social.jugendhacker.de/users/j_r/statuses/01KPBBN6FPFY6K6RZVMW3S0DYHThu, 16 Apr 2026 14:38:24 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 14:10:35 GMT]]>@varx @badkeys Im not arguing with internet strangers. Go dive off a bridge mate 👍

]]>https://board.circlewithadot.net/post/https://tech.lgbt/users/yama/statuses/116414784154258126https://board.circlewithadot.net/post/https://tech.lgbt/users/yama/statuses/116414784154258126Thu, 16 Apr 2026 14:10:35 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 14:06:58 GMT]]>@yama @badkeys Out of curiosity, what year are you posting from?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/varx/statuses/116414769966077446https://board.circlewithadot.net/post/https://infosec.exchange/users/varx/statuses/116414769966077446Thu, 16 Apr 2026 14:06:58 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 12:22:45 GMT]]>@16af93 @q @badkeys iirc BSA recommends at least 3000bits

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/trpalesz/statuses/116414360154926193https://board.circlewithadot.net/post/https://mastodon.social/users/trpalesz/statuses/116414360154926193Thu, 16 Apr 2026 12:22:45 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 12:09:44 GMT]]>@badkeys Way to go Telekom! Last time I found a 320 bit RSA key it was “protecting” people’s private information (https://palant.info/2023/01/25/ipinside-koreas-mandatory-spyware/#how-is-this-data-protected) and I even had a little difficulty finding a cryptography library that wouldn’t refuse working with a key so short.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/WPalant/statuses/116414308964515711https://board.circlewithadot.net/post/https://infosec.exchange/users/WPalant/statuses/116414308964515711Thu, 16 Apr 2026 12:09:44 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 11:13:53 GMT]]>@badkeys hot take: dkim does not matter anyway]]>https://board.circlewithadot.net/post/https://fe.disroot.org/objects/a7b75b74-c449-480e-b13b-f50738cd1524https://board.circlewithadot.net/post/https://fe.disroot.org/objects/a7b75b74-c449-480e-b13b-f50738cd1524Thu, 16 Apr 2026 11:13:53 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 10:54:22 GMT]]>@badkeys Modern DKIM implementations should not accept signatures made with RSA keys smaller than 1024 bits, nowadays, so it seems unlikely to me that you could do anything nefarious with a key this weak. The verifier would be equally faulty if it accepts weak keys.

See also: https://www.rfc-editor.org/rfc/rfc8301#section-3.2

]]>https://board.circlewithadot.net/post/https://mamot.fr/users/x0r/statuses/116414012625989196https://board.circlewithadot.net/post/https://mamot.fr/users/x0r/statuses/116414012625989196Thu, 16 Apr 2026 10:54:22 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 10:17:48 GMT]]>@badrihippo @badkeys Yes.

Everyone should be doing the same (rotating DKIM keys and publishing the old private keys). Here's my blog post on the subject:

https://diziet.dreamwidth.org/16025.html

]]>https://board.circlewithadot.net/post/https://mastodon.me.uk/users/Diziet/statuses/116413868823366231https://board.circlewithadot.net/post/https://mastodon.me.uk/users/Diziet/statuses/116413868823366231Thu, 16 Apr 2026 10:17:48 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 08:54:22 GMT]]>@badkeys RSA ?
You can literally get an API key for your python script to access a literal quantum computer. And someone already made shors alg. implementation exclusively for RSA cracking

If it were over 4096 bits its still Not Secure and crackable within seconds.
Literally Any modern post quantum algorirthm is orders of magnitude better...

]]>https://board.circlewithadot.net/post/https://tech.lgbt/users/yama/statuses/116413540785622288https://board.circlewithadot.net/post/https://tech.lgbt/users/yama/statuses/116413540785622288Thu, 16 Apr 2026 08:54:22 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 08:52:02 GMT]]>@lunareclipse @badkeys "bad companies", so most of them by nature ?

]]>https://board.circlewithadot.net/post/https://tech.lgbt/users/yama/statuses/116413531578147696https://board.circlewithadot.net/post/https://tech.lgbt/users/yama/statuses/116413531578147696Thu, 16 Apr 2026 08:52:02 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 07:56:36 GMT]]>@oscherler @tanja

Or they did not understand the problem?

]]>https://board.circlewithadot.net/post/https://chaos.social/users/m_berberich/statuses/116413313611555677https://board.circlewithadot.net/post/https://chaos.social/users/m_berberich/statuses/116413313611555677Thu, 16 Apr 2026 07:56:36 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 07:55:08 GMT]]>@bekopharm
Ich konnte sie auf ein Kontaktformular runterhandeln, musste aber versichern, dass der Transport dann nicht per eMail erfolgt. Ich habe ne ntfy-Instanz auf einem meiner Server laufen, das Webformular generiert jetzt eine Notification auf mein Smartphone.

Eigentlich wollte ich den Zugriff per Firewall auf die Admin-Netzwerke der Telekom zumachen, aber das war für sie absolut inakzeptabel.

Aber bei jeder Gelegenheit seine eigenen Kunden in Geiselhaft nehmen und rumprotzen, dass sie der größte Provider Deutschlands sind und damit eigene Regeln festlegen können, an die sich jeder zu halten hat.

]]>https://board.circlewithadot.net/post/https://social.linux.pizza/users/momo/statuses/116413307868163614https://board.circlewithadot.net/post/https://social.linux.pizza/users/momo/statuses/116413307868163614Thu, 16 Apr 2026 07:55:08 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 07:40:31 GMT]]>@badkeys@infosec.exchange the yafu help describes using siqs for this, which would take that server 2 to 3 hours, but using nfs it took only minutes]]>https://board.circlewithadot.net/post/https://nya.social/notes/819d953c038a36d740e84c3ehttps://board.circlewithadot.net/post/https://nya.social/notes/819d953c038a36d740e84c3eThu, 16 Apr 2026 07:40:31 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 07:40:00 GMT]]>@badkeys@infosec.exchange just a few days ago i broke an rsa384 key using yafu on my home server (a ~6 year old dell poweredge, fairly decent spec) as a practice run for something, and it took under 5 minutes]]>https://board.circlewithadot.net/post/https://nya.social/notes/819d953b88fe879abe0a1c51https://board.circlewithadot.net/post/https://nya.social/notes/819d953b88fe879abe0a1c51Thu, 16 Apr 2026 07:40:00 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 07:38:05 GMT]]>@Diziet 😮 never even thought this could be a thing!

So you're basically making it impossible to prove through DKIM signatures that a given email was actually sent from your server?

@badkeys

]]>https://board.circlewithadot.net/post/https://fosstodon.org/users/badrihippo/statuses/116413240783609971https://board.circlewithadot.net/post/https://fosstodon.org/users/badrihippo/statuses/116413240783609971Thu, 16 Apr 2026 07:38:05 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 07:37:55 GMT]]>@buherator @badkeys @mcr314 probably done by an apprentice anyway

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/janet_catcus/statuses/116413240144003313https://board.circlewithadot.net/post/https://hachyderm.io/users/janet_catcus/statuses/116413240144003313Thu, 16 Apr 2026 07:37:55 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 07:29:39 GMT]]>@selea @badkeys

no, sounds like they stayed for tooo long on a short length that could be cracked quickly.

they should upgrade to more bits, and re-roll their keys

]]>https://board.circlewithadot.net/post/https://helvede.net/users/kramse/statuses/116413207635083615https://board.circlewithadot.net/post/https://helvede.net/users/kramse/statuses/116413207635083615Thu, 16 Apr 2026 07:29:39 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 07:27:25 GMT]]>@momo Hab mich damit auch schon herum geärgert und mit einem "Musterbrief" frei gekauft: https://beko.famkos.net/2023/06/02/%c2%b7t%c2%b7%c2%b7%c2%b7error/

Die haben doch echt nicht mehr alle Latten am Zaun o0

]]>https://board.circlewithadot.net/post/https://indieweb.social/users/bekopharm/statuses/116413198864958767https://board.circlewithadot.net/post/https://indieweb.social/users/bekopharm/statuses/116413198864958767Thu, 16 Apr 2026 07:27:25 GMT<![CDATA[Reply to I reported an insecure DKIM key to Deutsche Telekom / T-Systems. on Thu, 16 Apr 2026 07:09:19 GMT]]>@badkeys

I don't remember have ever seen lower RSA keys size than 512 bits... We have a winner here !]]>https://board.circlewithadot.net/post/https://agora.l0g.eu/objects/97af061c-88f6-4d31-b2f6-3bb0e1176337https://board.circlewithadot.net/post/https://agora.l0g.eu/objects/97af061c-88f6-4d31-b2f6-3bb0e1176337Thu, 16 Apr 2026 07:09:19 GMT