The email message looks like this. This person used a church member's name and used a totally different email address. It went like this:


  Hi!
  
  How are you? (then gives a bad web address)
  
  Gary Mecham


Then, below that in the bottom left corner it says "Sent from my iPhone, with a fraudulent web address"

The email domain is totally different from the church member's actual domain.

I sent an email to the people (that I knew) that this imposter sent this to to warn them that it is NOT who they think it is. I work at a church. That's where I received the email, on the church's computer. I did click on the link, but we have McAfee Internet Security software on our computer and, quickly, it gave a warning message not to go to that website. So, of course, I didn't.

Can I report this to the FCC? Or who? It's not really a consumer spam, but I think it's an email to get people to click on a website that probably has a virus in it that will attack their computer.

I've added my answer here as I feel the existing ones don't directly address your question enough for my liking.
Let's look at RFC 4868 (regarding IPSec, however it covers the HMAC-SHA256 function you intend to use - em mine):

Block size:  the size of the data block the underlying hash algorithm
operates upon.  For SHA-256, this is 512 bits, for SHA-384 and
SHA-512, this is 1024 bits.
Output length:  the size of the hash value produced by the
underlying
hash algorithm.  For SHA-256, this is 256 bits, for SHA-384 this
is 384 bits, and for SHA-512, this is 512 bits.

As WhiteWinterWolf notes, longer than B (block size) is discouraged because the value must be hashed using SHA-256 first (i.e. 512 bits in this case) and less than L (output length) is discouraged (256 bits in this case). However, a 256 bit key is overkill as anything that is 128bits or greater cannot be brute forced in anyone's current lifetime, even if every computer in the world was working on cracking it.
Therefore I'd recommend a 128 bit key, generated with a cryptographically secure pseudo random number generator (CSPRNG). If you want to store this as text then a 128 bit key can be represented by generating a random 32 character length hex string, or alternatively you could generate 16 random bytes and then run them through a base64 function.
