Add-DnsServerResourceRecord fails to support 2048-bit DKIM records

[mcnaugha]

A note about this tool limiting TXT records to 254 characters might be useful. I lost hours to trying to find a solution but I don’t think there is one. The RFC defines TXT strings as being allowed up to 255 characters and you can have multiple strings. Microsoft knows this, at least in terms of the DNS UI tool supporting 255 characters and multiple strings. If an organisation wishes to add a 2048-bit DKIM signature to 160 zones then this tool creates a severe handicap for them. Thanks.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 64226e08-8175-d9b6-1272-a4e016413fb9
• Version Independent ID: fcb077f7-9145-7727-21c6-8c4ed7fda8fd
• Content: Add-DnsServerResourceRecord (DnsServer)
• Content Source: docset/winserver2019-ps/dnsserver/Add-DnsServerResourceRecord.md
• Product: w10
• Technology: ****
• GitHub Login: @Kateyanne
• Microsoft Alias: v-kaunu

[o0nj]

Hello, @mcnaugha You can provide feedback on the cmdlet itself via the PowerShell Community.

The issues section of this repository is intended for documentation problems.

Feel free to reply if there is anything else that could be done to improve the document.

Thanks.

[mcnaugha]

As my comment said... it is a documentation issue that it does not warn admins. That's what the first sentence said. It's not product feedback. I've already left the feedback in relevant forums. It needs one of those purple warning banners.

[o0nj]

@mcnaugha

Thank you for the clarification! It has been ambiguous to me whether it’s a feedback towards documentation or the module. I am routing this feedback to an independent contributor and expect an update soon.

This documentation is partially open source. Please note that if you have any further feedback, you are welcome to come up with a PR by editing the associated file via GitHub, and your contribution will be reviewed. You don’t need to do that for this specific issue.

Thanks again, and stay safe.

[Levan777]

Anything on this? I just can't figure out how can I add long text in DNS by powershell :( please help someone

[velkovb]

@mcnaugha Thank you for you feedback.

I have been trying to replicate the issue but was not able to. Successfully added a txt record with 255 characters. Could your provide an example of the command that leads to the error?

What is the environment you are running this in (OS, Powershell versions)?

[o0nj]

Closing the issue based on the comment above. Thanks.

[mcnaugha]

@mcnaugha Thank you for you feedback.

I have been trying to replicate the issue but was not able to. Successfully added a txt record with 255 characters. Could your provide an example of the command that leads to the error?

What is the environment you are running this in (OS, Powershell versions)?

I would ask you the same question. Can you supply the command you used that worked? No one seems to know the syntax to support 255 characters. It's not the same as for a 1024-bit key.

[mcnaugha]

Here is an example 2048-bit key:

MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy6OAXCmjYT823gq+DXRjXdsypt7iepfl4pkvLRVN8wRwoND2Fk2aVlG+CitAeJ0nqWn7JAPjoTXpFtHnOWMN7ay/atQd+DcLLHfJkpRvsYSIQ1jkIp17CkWF6G+nwLGJcNFndOdB8oawpppyESE7+DiZae8bDicaTK8oPU0J7iogeZ1fgvmutwNtNzZHiSgwF9euCiX6lTmGe+0oZ+gRUJnUmZevh//IZ+NyDkRV2kPxQBtM8brHUp
RL1c11q/CA0kC6C3ku+Pqmf6A8CGT+qvlCeQ2lVqlBydQL5UjiixUEwkSrgUEKoKE2Hqw97WrDEJZqngtuqma9hWoAsKVbzwIDAQAB

$domain = "aitkenhead.n-lanark.sch.uk"

$dkim = "v=DKIM1;k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7+pAFJv0q84jSLITxdjIQPpGsOtfwF+0G1cwal84rSLjzBHrrxnyiKKAqqqxqyNnLVAvhS/sE/7w9xnzRE7vGINBXkcpHziLnxfAFraMJ7qkkRLyC7TBauGwOtBT3sMwSrkNlAQovZ9JJiUPvJvSEFocmfpjHZrTgXXp5FWZGtQIDAQAB"

$dkim2 = "v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy6OAXCmjYT823gq+DXRjXdsypt7iepfl4pkvLRVN8wRwoND2Fk2aVlG+CitAeJ0nqWn7JAPjoTXpFtHnOWMN7ay/atQd+DcLLHfJkpRvsYSIQ1jkIp17CkWF6G+nwLGJcNFndOdB8oawpppyESE7+DiZae8bDicaTK8oPU0J7iogeZ1fgvmutwNtNzZHiSgwF9euCiX6lTmGe+0oZ+gRUJnUmZevh//IZ+NyDkRV2kPxQBtM8brHUp
RL1c11q/CA0kC6C3ku+Pqmf6A8CGT+qvlCeQ2lVqlBydQL5UjiixUEwkSrgUEKoKE2Hqw97WrDEJZqngtuqma9hWoAsKVbzwIDAQAB"

Add-DnsServerResourceRecord -DescriptiveText $dkim -Name sea1024._domainkey -Txt -ZoneName $domain -TimeToLive 0:1:0:0

Add-DnsServerResourceRecord -DescriptiveText $dkim2 -Name sea2048._domainkey -Txt -ZoneName $domain -TimeToLive 0:1:0:0

Have tried splitting up the text like this:

Add-DnsServerResourceRecord -DescriptiveText "v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy6OAXCmjYT823gq+DX" "RjXdsypt7iepfl4pkvLRVN8wRwoND2Fk2aVlG+CitAeJ0nqWn7JAPjoTXpFtHnOWM" "N7ay/atQd+DcLLHfJkpRvsYSIQ1jkIp17CkWF6G+nwLGJcNFndOdB8oawpppyESE7" "+DiZae8bDicaTK8oPU0J7iogeZ1fgvmutwNtNzZHiSgwF9euCiX6lTmGe+0oZ+gR" "UJnUmZevh//IZ+NyDkRV2kPxQBtM8brHUpRL1c11q/CA0kC6C3ku+Pqmf6A8CGT" "+qvlCeQ2lVqlBydQL5UjiixUEwkSrgUEKoKE2Hqw97WrDEJZqngtuqma9hWoAsKV" "bzwIDAQAB" -Name sea2048._domainkey -Txt -ZoneName $domain -TimeToLive 0:1:0:0

As someone suggested that multiple strings were supported but this resulted in a space between each string that breaks the key.

[velkovb]

@mcnaugha Thanks. I just did a random string with 255 characters length. I will try it again and provide the command and test you scenario. May I also ask about the PowerShell and OS versions that you are using? This issue is opened under the Server 2019 version of the article.