DKIM Generator
Generate a DKIM key pair and DNS record in your browser.
Generate a fresh DKIM key pair in your browser, then publish the public half in DNS and load the private half into your mail server. Everything happens locally with WebCrypto. The keys are never sent anywhere.
The DKIM Generator creates a fresh DKIM key pair entirely in your browser and formats the matching DNS record so you can publish it. DKIM (RFC 6376) works with two halves: a private key your mail server uses to sign outbound messages, and a public key you publish in DNS at selector._domainkey.yourdomain.com. Receiving servers fetch the public key to confirm a message was signed by you and not altered in transit.
What the tool produces
You choose a selector (for example mail2026) and a key type. The generator returns a private key to install on your sending platform and a TXT record containing v=DKIM1, the key type (k=rsa or k=ed25519) and the public key in p=. RSA 2048-bit is the recommended default for broad compatibility; ed25519 keys are shorter and modern but should be published alongside an RSA key because not every receiver supports them yet.
How to deploy and verify
Keep the private key secret. It never needs to leave your server, and this tool never transmits it. Then:
- Publish the TXT record at the selector host shown, splitting long values into quoted strings if your DNS panel requires it.
- Install the private key in your mail platform under the same selector.
- Wait for DNS to propagate, then confirm publication with our DKIM Checker.
- Send a test message and inspect the
DKIM-Signatureheader to confirm a pass.
Remember that DKIM alone does not stop spoofing; pair it with an aligned SPF record and a DMARC policy at enforcement. If running keys and rotation by hand is more than you want to manage, our done-for-you service handles signing and rotation for you; see how we enforce.
Frequently asked questions
Is my private key safe in the browser?
Yes. The key pair is generated locally in your browser and the private key is never sent to our servers. Copy it straight into your mail platform and store it securely, because anyone holding it can sign mail as your domain.
Should I choose RSA or ed25519?
Use RSA 2048-bit for the widest compatibility, as every major receiver supports it. Ed25519 keys are shorter and efficient but not universally verified, so if you use one, publish an RSA key under a second selector as a fallback.
What selector name should I use?
Any label works, but a dated or descriptive name like s2026a makes key rotation easier to track. Each selector maps to one published key at selector._domainkey.yourdomain.com, so unique names let you run old and new keys side by side during a rotation.
My DNS provider rejects the long record. What do I do?
A single DNS string is limited to 255 characters, and a 2048-bit public key is longer than that. Split the value into multiple quoted strings within one TXT record; many panels do this automatically, or use our record splitter.
How do I confirm the key is working after publishing?
Once DNS propagates, run the selector through our DKIM Checker to confirm the public key is live and well-formed. Then send a test message and check that the DKIM-Signature header verifies as a pass at the receiving end.
Does generating a DKIM key protect my domain by itself?
No. DKIM only signs messages; it does not instruct receivers to act on failures. You still need an aligned SPF record and a DMARC policy at p=quarantine or p=reject to stop spoofing; see how to enforce.