DKIM Record Generator
Paste the public key your mail server produced, pick a selector, and copy the DKIM TXT record. The record is built in your browser; nothing is uploaded.
How to use
- Generate a key pair on your own machine. The FAQ below has the exact OpenSSL commands. Keep the private key on the machine that signs your mail.
- Pick a selector, a short label such as
s1ormail2024. Your record will live at that label under_domainkey. - Paste the base64 public key into the tool, choose the key size, and copy the TXT record it builds.
- Publish the record at the hostname shown, then confirm it resolves with
dig +short selector._domainkey.your-domain.com TXT.
How DKIM works
DKIM proves a message really came from your domain and was not changed in transit. Your mail server signs each outgoing message with a private key and adds a header naming the selector it used. The receiving server looks up the matching public key in DNS and checks the signature.
That lookup goes to a TXT record at selector._domainkey.your-domain.com, and the record is v=DKIM1; k=rsa; p=BASE64_PUBLIC_KEY. The v tag marks the DKIM version, k names the key type, and p carries the key itself. One domain can publish several selectors at once, which is how you rotate keys without interrupting mail flow.
Use a 2048-bit key for new records. A 1024-bit key still verifies today, but it is the legacy minimum and brute-forcing one is within reach of well-funded attackers, so 2048 bits is what new deployments should pick.
This generator only assembles and checks the record structure. It cannot query live DNS, so it cannot tell you whether the record is published or correct in the wild. After you publish, verify withdig and send a test message to a checker such as Mail-tester to see the signature verify end to end.
Frequently asked questions
Does the DKIM generator keep a record of my domain or public key?
No. Your domain, selector, and the public key you paste stay in the browser tab, and the record text is assembled locally. The tool makes no DNS lookups and cannot see your live records. Nothing is sent to a server, nothing is saved on our side, and nothing is written to your browser's storage. The site sets no cookies and has no accounts; if an ad is shown, the ad network follows its own policies but still never receives your key material.
Where does the DKIM record go in DNS?
Publish the record as a TXT record at selector._domainkey.your-domain.com. A selector is a short label of letters, digits, hyphens, or underscores (no dots), and every selector is its own key slot. With selector mail2024 and domain example.com, the hostname is mail2024._domainkey.example.com.
How do I generate a key pair for DKIM?
Run openssl genrsa -out dkim_private.pem 2048 to create the private key, then openssl rsa -in dkim_private.pem -pubout -outform DER | openssl base64 -A to print the base64 public key. The private key stays on the machine that signs your mail. Only the printed public key goes into DNS.
Should I use a 1024-bit or a 2048-bit DKIM key?
Use 2048 bits. A 1024-bit key still verifies, but it is the legacy minimum and is considered weak for new deployments. The generator warns when you pick 1024 bits and when the pasted key length does not look like a real RSA SPKI public key.
Do I still need SPF and DMARC if I have DKIM?
Yes. DKIM signs individual messages, SPF authorizes your sending hosts, and DMARC tells receivers what to do when checks fail. DMARC requires at least one of SPF or DKIM to pass with alignment, and SPF evaluation stops after 10 DNS lookups, so keep the SPF record lean. Build and test all three: this generator alongside the SPF and DMARC record generators.
Can this tool check that my record is live?
No. The tool validates the record structure, meaning selector shape, domain shape, and base64 key shape, but it cannot query live DNS. After publishing, confirm the record resolves with dig +short selector._domainkey.your-domain.com TXT.