How to Generate a DKIM Key and the DNS Record to Publish

A DKIM setup is a key pair: the private key signs your outgoing mail and the public key goes in DNS as a TXT record at selector._domainkey.yourdomain.com. The DKIM key generator creates a 2048-bit RSA pair in your browser, with the exact record to publish. Enter your domain and a selector and press generate.

Check first that you need it. Most hosted services make the key for you.

Do you need your own key

Only if you run the signing yourself. Google Workspace and Microsoft 365 generate the key in their admin consoles and give you a record to publish, so a key from a generator will not work with them. Our guides cover Google Workspace and Microsoft 365. You need your own key for a self-hosted server such as Postfix with OpenDKIM, Exim or PowerMTA, or a service that accepts a key you supply, such as Amazon SES with Bring Your Own DKIM.

Step 1: enter the domain and a selector

The selector is any label you choose, such as s1 or mail2026. It is the s= tag in each signature, defined in RFC 6376. Use one you can change at each rotation.

Step 2: keep 2048 bits and generate

RFC 8301 says signers must use RSA keys of at least 1,024 bits and should use at least 2,048. Keep 2048 unless your DNS host cannot hold a long TXT value. The key is made with the browser's WebCrypto API, so it never leaves your device. The private key is in PKCS#8 PEM format, which OpenDKIM and Exim read directly.

To do the same by hand with OpenSSL:

openssl genrsa -out dkim.pem 2048
openssl rsa -in dkim.pem -pubout -outform der | openssl base64 -A

The second command prints the value for p=.

Step 3: publish the TXT record

Add a TXT record with the host name and value shown, for example host s1._domainkey and a value starting v=DKIM1; k=rsa; p= followed by the key. A 2048-bit key makes a value of about 400 characters, and one DNS string holds at most 255, so it is stored as several strings that receivers join. Panels such as Cloudflare's split it for you. For a BIND zone file or Route 53, use the split version the generator shows. Why long DKIM records break has the detail.

Step 4: install the private key and confirm

Put the private key where your signer reads it, with permissions only that process can use, and set it to sign with the same selector and domain. Then read the record back:

dig +short TXT s1._domainkey.example.com
nslookup -type=txt s1._domainkey.example.com

Send a test message to a mailbox you own and look for dkim=pass in the headers. To check a domain's DKIM across selectors in bulk, use the bulk DKIM checker; to test key strength, see checking your DKIM key length.

Rotating the key

Publish a new selector, switch signing over, and remove the old record a few days later, once mail signed with it has been delivered. Rotating to 2048-bit keys walks through it.

What this tool cannot do

• It makes RSA keys only. Ed25519 keys (RFC 8463) are not generated.
• It does not publish the record or configure your server.
• The private key exists only on the page. Close it unsaved and you need a new pair.
• Keys from here cannot be used with platforms that generate their own.

Check the addresses you send to

Signing proves the mail is yours; the address still has to exist. Upload your list on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason, and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.

Generate your key now

Open the DKIM key generator.