The badkeys project reported a 384-bit RSA DKIM key at dkim._domainkey.t-systems.nl to Deutsche Telekom / T-Systems, who asked for more explanation and then declared it “out of scope” for the bug bounty.
So badkeys factored it (cado-nfs handles 384-bit RSA in a few hours on a modern PC) and published the recovered private key in the same post: no factoring required for the next person who wants to sign mail as T-Systems.
Badkeys author Hanno Böck already scanned DKIM records in 2024 and found keys still vulnerable to the Debian OpenSSL bug (CVE-2008-0166) as well as RSA keys of 512 bits and below.
RFC 8301 has required DKIM signers to use RSA keys of at least 1024 bits since 2018, and tells verifiers not to accept signatures made with anything smaller.
2048-bit keys have been the recommended minimum for over a decade, so this is less “edge case” and more “did anyone look at this since 2010?”
