DKIM Generator
Generate a DKIM key pair
Generate a DKIM key pair
Choose a key type and press Generate. You publish the public key as a DNS TXT record and install the private key on your mail server to sign outgoing mail.
Tool features
4 checks
RSA & Ed25519 key pairs
1024 to 4096-bit RSA plus RFC 8463 Ed25519, generated with your browser's Web Crypto API
Ready-to-publish TXT record
The exact host, value and 255-character split form your DNS provider expects
Nothing leaves your device
Keys are created locally — the private key is never transmitted, logged or included in exports
Validation & next steps
Every key ships with a selector/length checklist and step-by-step publishing instructions
What is DKIM & how it works
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every message you send. The matching public key is published in DNS under a selector, so receiving servers can verify the message really came from your domain and wasn't altered in transit — a core pillar of email authentication alongside SPF and DMARC.
This generator creates a DKIM public/private key pair and the exact DNS TXT record to publish, entirely in your browser — the private key never leaves your device. You keep the private key on your mail server for signing, and publish the public key atselector._domainkey.yourdomain.com so the world can verify your mail.
Selector
A label (e.g. s1, mail) that lets a domain publish multiple DKIM keys and rotate them without downtime.
Public/private key pair
The private key signs outgoing mail on your server; the public key in DNS lets receivers verify the signature.
Key length
2048-bit RSA keys are the modern recommendation — stronger than 1024-bit while still widely supported.
How to use this tool
1
Enter your domain and selector
Provide the sending domain and a selector name such as s1 or mail.
2
Pick a key type
RSA 2048 suits almost everyone; Ed25519 is available for modern signers.
3
Publish the public key
Add the generated TXT record at selector._domainkey.yourdomain.com in your DNS.
4
Configure your mail server
Install the private key on your mail server so it signs every outgoing message.
Related tools
4 tools
DKIM Lookup
Find DomainKeys Identified Mail (DKIM) records for email message signing and verification
SPF Generator
Generate SPF records to authorize mail servers for your domain with visual builder
DMARC Generator
Generate DMARC policy records for email authentication with policy configuration options
Email Health Checker
Comprehensive email deliverability check including SPF, DKIM, DMARC, and MX records
Frequently asked questions
7 Q&A
A selector is a short label that identifies which key to use, published at selector._domainkey.yourdomain.com. Using selectors lets you run multiple keys and rotate them without breaking mail flow.
Use 2048-bit RSA. It's the current best-practice balance of security and compatibility; 1024-bit is considered weak, and some providers reject very long 4096-bit records.
Ed25519 (RFC 8463) produces a much shorter record and is faster, but not every receiver verifies it yet. The safe approach is to publish an Ed25519 selector alongside an RSA one and sign with both.
The private key stays on your mail server (or with your email provider) to sign outgoing messages. Only the public key is published in DNS.
TXT strings are capped at 255 characters, so long RSA keys must be published as several quoted strings. This tool shows the ready-to-paste split form; many providers also split the value for you automatically.
DKIM proves a message wasn't altered and came from your domain; SPF authorizes sending servers; DMARC ties them together and tells receivers what to do when authentication fails. You want all three.