With a check for our email infrastructure it came to my attention that Zoho uses an unsecure key strenght for signing email (RSA 1024), which has been deemed insecure by NIST since 2015. I have contacted customer support, but I got the message that they can't do anything about it right now and there is no roadmap available to the improvement to this.

With this post I hope to make more people aware of this problem and hopefully it will get higher up the roadmap, as email security is a very important to keep your users and customers safe!

The best solution would be to implement RSA with a strength of 3072 bits or higher, or if this is too long make use of EC.