DKIM record generator
Make a DKIM key pair and get the TXT record to publish and the private key for your mail server. The keys are made in your browser and never leave your device; we only count that the generator was used. Free, no signup.
Made with your browser's built-in cryptography: nothing you enter and no part of the key is sent to us.
Your -bit DKIM key
1. Publish this TXT record
- Type
- TXT
- Host / name
- Value
My DNS host rejects values over 255 characters
Publish the value as these quoted strings, in this order, in one TXT record:
2. Give your mail server the private key
Keep this file private: anyone with it can sign mail as your domain. Do not email it or store it in a shared folder. We never see it, so we cannot send it again.
Show the private key
For Amazon SES, paste the key as one line, without the BEGIN and END lines:
3. Check it is live
Once the record is published, run the DKIM check: it reports the key's type and size.
Or ask DNS directly:
Get alerted if a DKIM key disappears or changes: monitoring re-checks your records on a schedule and tells you when they change.
Start monitoring →What you get
One key pair: the public half in DNS, the private half on your server.
- TXT record
- v=DKIM1; k=rsa; p= followed by your public key, at selector._domainkey.yourdomain. Receivers fetch it to verify each signature.
- Private key
- A PEM file (PKCS #8) your mail server signs with. OpenDKIM, Exim, Postfix setups and most mail servers read it as is.
- Selector
- The name the key is published under. s1 is one the DKIM check always looks for; use s2 for the next key when you rotate. How selectors work.
- Key size
- RSA, 2048-bit by default. The record is then over 255 characters, which most DNS hosts split for you.
Questions, answered
Before you publish.
Is the private key sent anywhere?
No. The key pair is made by your browser's built-in cryptography on this page, on your device. Nothing you type and no part of the key is sent to us: the page only counts that the generator was used. Close the tab without downloading and the key is gone.
Should I use a 1024-bit or a 2048-bit key?
2048 bits. 1024-bit keys still pass but are weaker, and some receivers already treat them with suspicion. Choose 1024 only if your DNS host cannot publish a TXT value longer than 255 characters.
What is a selector?
The name your key is published under, at selector._domainkey.yourdomain. Your mail server puts it in the s= tag of every signature so receivers know which key to fetch. Use a new selector when you rotate keys, so the old and new key can be published side by side.
My DNS host rejects the long record. What now?
A 2048-bit record is longer than 255 characters, the limit for one TXT string. Most DNS hosts split it for you; if yours does not, publish it as the quoted strings shown with the result, in that order.