Your DKIM Key Is Too Long for Route 53 (And How to Fix It)

I was setting up DKIM for a domain on KaiMail and hit a wall. I copied the DKIM public key from the dashboard, pasted it into the AWS Route 53 console as a TXT record, clicked save, and got a big red error banner:

CharacterStringTooLong (Value is too long)

The full DKIM value was right there in the error message, mocking me. Route 53 refused to save it. No helpful suggestion, no "did you mean..." prompt. Just rejection.

If you have run into this, you are not alone. This is one of the most common DNS gotchas with DKIM especially on AWS R53 (I think, just looking through the search results) and the fix is simple once you know what is going on.

Why This Happens

The issue is not Route 53 being difficult. It is a limitation in the DNS TXT record specification itself.

A single TXT record string has a maximum length of 255 characters (per RFC 7208). That limit made sense decades ago, but modern DKIM public keys (especially 2048-bit RSA keys, which are now the standard) easily exceed it. A typical 2048-bit DKIM key produces a TXT value of around 400 to 500 characters. The key itself is fine. DNS just cannot carry it in one piece.

Route 53 enforces this 255-character limit strictly, which is why you get CharacterStringTooLong the moment you paste your DKIM value in.

The Fix: Split It Into Quoted "Chunks"

The DNS specification anticipated this problem. A single TXT record can contain multiple strings, and the receiving DNS resolver concatenates them back into one value automatically. All you need to do is split your long value into chunks of 255 characters or fewer, each wrapped in double quotes, separated by spaces.

Here is what it looks like in practice. Say your DKIM value is:

"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr09HrXma8mAdtjJg5KbAI8SNr9KMxrYYFF3T+GV19adopztPvSJvcRwwejcKwf3WUc1Fk4g+6e0prUePDtEJtG5OF6e03/7OWecfzhwup3FJ3s25+qHJ22+FMcv3OZOuxJp5uEWzAgQnQOKHRkDqwtmiaTOzxKY177Ui5+1CKQEyg2S+2K/Ao1906Ow018CjL+4KDU7IFiEaM3yq9yQl9iIZ3Ix1ZNygHP0Q5qJxj3wVyrb9lfzkpAVPDQQFWLRRDmAx02IA4TF2A9tCc8KTqlkEa1Ne/YQZZiRlzEq88VaS3R6eThSFU+j+sykblcc45ick08MXbgfS16IsrgC+9wIDAQAB"

That is way over 255 characters. You split it into multiple quoted strings like this:

"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr09HrXma" "8mAdtjJg5KbAI8SNr9KMxrYYFF3T+GV19adopztPvSJvcRwwejcKwf3WUc1Fk4" "g+6e0prUePDtEJtG5OF6e03/7OWecfzhwup3FJ3s25+qHJ22+FMcv3OZOuxJp5" "uEWzAgQnQOKHRkDqwtmiaTOzxKY177Ui5+1CKQEyg2S+2K/Ao1906Ow018CjL+4KDU7IFiEaM3yq9yQl9iIZ3I" "x1ZNygHP0Q5qJxj3wVyrb9lfzkpAVPDQQFWLRRDmAx02IA4TF2A9tCc8KTqlkEa1Ne" "/YQZZiRlzEq88VaS3R6eThSFU+j+sykblcc45ick08MXbgfS16IsrgC+9wIDAQAB"

Each chunk is under 255 characters (it's arbitary, as long as it's under 255 characters), wrapped in its own pair of double quotes, and separated by a space. That is it. Paste this into the Route 53 TXT record value field, and it saves without complaint.

Important: Spaces, Not Newlines

There is a common mistake that trips people up in the Route 53 console. When you split the value into multiple quoted strings, separate them with spaces on the same line, not newlines.

If you put each quoted chunk on a separate line in the Route 53 console, Route 53 interprets each line as a separate TXT record rather than parts of one record. Instead of one DKIM record with multiple string segments, you end up with four or five independent TXT records, and DKIM validation fails because none of them contain the complete key.

A detailed write-up on Classmethod's developer blog (in Japanese) covers this specific pitfall if you want the full technical explanation.

Step by Step in the Route 53 Console

1. Go to your hosted zone and click Create record.
2. Set the record type to TXT.
3. For the record name, enter the DKIM selector provided by your email service (e.g., kaimail._domainkey).
4. In the value field, paste your DKIM value split into multiple quoted strings on a single line, separated by spaces.
5. Click Create records.

If you are using the AWS CLI instead:

aws route53 change-resource-record-sets --hosted-zone-id YOUR_ZONE_ID --change-batch '{
  "Changes": [{
    "Action": "UPSERT",
    "ResourceRecordSet": {
      "Name": "kaimail._domainkey.yourdomain.com",
      "Type": "TXT",
      "TTL": 3600,
      "ResourceRecords": [{
        "Value": "\"v=DKIM1; k=rsa; p=FIRST_CHUNK\" \"SECOND_CHUNK\" \"THIRD_CHUNK\""
      }]
    }
  }]
}'

How to Verify It Worked

After saving the record, confirm that DNS resolvers see the complete, concatenated value:

dig TXT kaimail._domainkey.yourdomain.com +short

You should see the full DKIM value returned, possibly still displayed as multiple quoted segments. That is normal. The receiving mail server concatenates them when validating signatures.

You can also use online tools like MXToolbox to check your DKIM record. Enter kaimail._domainkey:yourdomain.com and it will show you whether the key is correctly published.

This Is Not Route 53 Specific

Worth noting: this is not an AWS problem. The 255-character limit applies to all DNS providers. Some providers (like Cloudflare) silently handle the splitting for you behind the scenes, which is why you might not have encountered this before. Route 53 does not do that. It expects you to handle the splitting yourself, which is more transparent but less forgiving.

Andrew Ray's blog post on setting up custom domains with Route 53 was one of the first write-ups I found that explained this clearly. AWS's own knowledge base article also covers the resolution.

Quick Reference

If you are setting up DKIM for KaiMail specifically, the dashboard provides the full public key. Just split it as described above before pasting into Route 53, and you are done.