One half of a key pair used to sign email. The private key, kept on your mail server, adds a signature to each message; the public key, published in DNS, lets receivers check that signature and confirm the message came from your domain unchanged.

How do I create a DKIM record?

Generate an RSA key pair, publish the public key as a TXT record at selector._domainkey.yourdomain.com with the value v=DKIM1; k=rsa; p= followed by the key, and configure your mail server to sign with the private key. The generator above does the first two steps in your browser.

What does a DKIM record look like?

A TXT record at a host such as s1._domainkey.example.com, with a value like v=DKIM1; k=rsa; p=MIIBIjANBgkqh… where everything after p= is the base64 public key. A 2048-bit key makes the value about 400 characters long.

How do I generate a DKIM record for Google Workspace?

In the Google Admin console, go to Apps > Google Workspace > Gmail > Authenticate email, pick the domain and click Generate New Record. Publish the TXT record it shows at your DNS host, then click Start authentication. Don't use a key from this page; Google keeps the private key itself.

Is it safe to generate DKIM keys online?

Only if the key is generated on your device. This generator uses your browser's WebCrypto API, so the private key is never sent to our servers or anyone else's. A generator that creates keys server-side has had a copy of your private key.

Should I use a 1024-bit or 2048-bit DKIM key?

2048-bit. RFC 8301 says signers should use at least 2,048 bits, and Gmail and Yahoo recommend it for bulk senders. Use 1,024 only when your DNS provider can't hold the longer record.

What is a DKIM selector?

A label you choose that tells receivers where to find the public key: the selector s1 on example.com means the key is at s1._domainkey.example.com. It appears as s= in each message's DKIM-Signature header, and using a new one for each key makes rotation painless.

Can I use this key with Google Workspace or Microsoft 365?

No. Both generate the DKIM key themselves and only give you a DNS record to publish. This generator is for servers and services where you supply the private key yourself.

DKIM record generator: create a DKIM key pair in your browser

A DKIM setup is a key pair: the private key signs your outgoing mail and the public key goes in DNS as a TXT record at selector._domainkey.yourdomain.com. Enter your domain and a selector and this DKIM generator creates a 2048-bit RSA pair with your browser's WebCrypto, then gives you the record to publish. The private key never leaves your browser.

SimpleAPI

Sample result

This is a 2048-bit DKIM key for acme.example, published at s1._domainkey.

Selector: s1._domainkey
Domain: acme.example
Private key: PKCS#8 PEM, stays on the page

What this means for you

Add the TXT record to your DNS and load the private key into your mail server.

Next step:Check the published DKIM

2048-bit or 1024-bit RSA key pairs
Builds the selector._domainkey host name
Splits long keys into 255-character strings
Private key as a downloadable .pem file

DKIM
RSA
TXT record

By SimpleVerifier Team · Last updated October 17, 2026 · Runs in your browser; nothing you paste is sent to us

How do I generate a DKIM record for my domain?

Enter the domain you send from and a selector, a label for this key such as s1 or mail2026.
Keep 2048-bit unless your DNS host can't store long TXT values. Press Generate DKIM keys.
Add a TXT record with the host name and value shown. Use the split version if your DNS host asks for 255-character strings.
Install the private key in the server or service that signs your mail, set it to sign with the same selector and domain, then check the record with the DKIM checker and look for dkim=pass in a test message's headers.

Example

You enter: The domain acme.example, the selector s1 and a 2048-bit key.
You get: A TXT record for s1._domainkey.acme.example with the value v=DKIM1; k=rsa; p=…, also split into 255-character strings, plus the private key as a PKCS#8 .pem file to install in your mail server.
Limits: Keys are generated in your browser and the private key never leaves the page; 2048-bit or 1024-bit RSA only.

Do I need to generate my own DKIM key?

Only if you run the signing yourself; most hosted mail services create the key for you. Google Workspace generates it in the Admin console under Gmail > Authenticate email, with a Generate New Record button (Google's DKIM setup), and Microsoft 365 and most email platforms do the same in their own settings. They only ask you to publish a DNS record, so you can't use a key from here with them; see our guides for Google Workspace and Microsoft 365.

If your DNS is at GoDaddy, Cloudflare or another registrar, that's only where you publish the record. The key comes from whoever sends your mail. You need your own key when you run the signing yourself: Postfix with OpenDKIM, Exim, PowerMTA or another self-hosted server, or a service that lets you bring your own key, such as Amazon SES's Bring Your Own DKIM option. That's what this generator is for.

Is it safe to use an online DKIM generator?

Only if the key is created on your device, as it is here. Anyone holding your DKIM private key can sign mail that passes DKIM for your domain. A generator that creates keys on its server has seen your key, whatever its privacy policy says. This page uses the browser's built-in WebCrypto API (crypto.subtle.generateKey), the same code browsers use for HTTPS, so the key is created on your device and never transmitted. Save it before you close the page; we can't recover it.

The private key is in PKCS#8 PEM format (BEGIN PRIVATE KEY), which OpenDKIM, Exim and most other signers read directly. Store it with permissions only the signing process can read.

What DKIM key size and selector should I use?

Use a 2048-bit RSA key and a selector you can change at each rotation. RFC 8301 says signers must use RSA keys of at least 1,024 bits and should use at least 2,048. Gmail and Yahoo both recommend 2,048-bit keys for bulk senders, so that's the default; why 2048-bit matters covers the history. Pick 1,024 only if your DNS host can't store a long TXT value.

A 2048-bit public key makes a record of about 400 characters. A single DNS TXT string holds at most 255, so the record is stored as several strings that receivers join back together. Panels such as Cloudflare's split it for you; BIND zone files and Route 53 want the quoted, split version shown in the result.

The selector is any label you like, defined in RFC 6376 as the s= tag in each signature. It lets you run several keys at once. Use a new selector when you rotate, publish the new key, switch signing over, and remove the old record a few days later, once mail signed with it has been delivered.

Is this the same as generating a DKIM key with OpenSSL?

The result is the same kind of key. The difference is how much you assemble by hand:

	This generator	OpenSSL	opendkim-genkey
Where it runs	Your browser	Your terminal	Your mail server
DNS record value	Ready to paste, split if needed	Build `v=DKIM1; k=rsa; p=` yourself	Written to a `.txt` file
Private key format	PKCS#8 PEM	PEM	PEM
Needs installing	No	Usually preinstalled	The OpenDKIM package

With OpenSSL: openssl genrsa -out dkim.pem 2048, then openssl rsa -in dkim.pem -pubout -outform der | openssl base64 -A prints the value for p=.

Who uses this tool, and for what?

IT admins: Create the key for a Postfix and OpenDKIM, Exim or PowerMTA server, publish the record, and rotate to a new selector on a schedule.
SaaS teams: Sign transactional mail from your own app servers, or bring your own key to a service such as Amazon SES, without the private key ever passing through a third-party website.
Cold emailers: If you run your own sending infrastructure rather than Google Workspace inboxes, generate a key per domain and confirm each one with the bulk sender checker.
Agencies: Set up DKIM for a client's self-hosted mail server and hand over the private key directly, with no copy left on any server.

What can’t this tool tell you?

RSA keys only. Ed25519 DKIM keys (RFC 8463) aren't generated here, and many receivers still verify only RSA.
It creates keys; it doesn't publish the record or configure your server. Both are done in your DNS host and your mail software.
Keys from here can't be used with Google Workspace, Microsoft 365 or platforms that generate their own.
The private key exists only on this page. Close it without saving and you'll need to generate a new pair.

Common questions

What is a DKIM key?: One half of a key pair used to sign email. The private key, kept on your mail server, adds a signature to each message; the public key, published in DNS, lets receivers check that signature and confirm the message came from your domain unchanged.
How do I create a DKIM record?: Generate an RSA key pair, publish the public key as a TXT record at selector._domainkey.yourdomain.com with the value v=DKIM1; k=rsa; p= followed by the key, and configure your mail server to sign with the private key. The generator above does the first two steps in your browser.
What does a DKIM record look like?: A TXT record at a host such as s1._domainkey.example.com, with a value like v=DKIM1; k=rsa; p=MIIBIjANBgkqh… where everything after p= is the base64 public key. A 2048-bit key makes the value about 400 characters long.
How do I generate a DKIM record for Google Workspace?: In the Google Admin console, go to Apps > Google Workspace > Gmail > Authenticate email, pick the domain and click Generate New Record. Publish the TXT record it shows at your DNS host, then click Start authentication. Don't use a key from this page; Google keeps the private key itself.
Is it safe to generate DKIM keys online?: Only if the key is generated on your device. This generator uses your browser's WebCrypto API, so the private key is never sent to our servers or anyone else's. A generator that creates keys server-side has had a copy of your private key.
Should I use a 1024-bit or 2048-bit DKIM key?: 2048-bit. RFC 8301 says signers should use at least 2,048 bits, and Gmail and Yahoo recommend it for bulk senders. Use 1,024 only when your DNS provider can't hold the longer record.
What is a DKIM selector?: A label you choose that tells receivers where to find the public key: the selector s1 on example.com means the key is at s1._domainkey.example.com. It appears as s= in each message's DKIM-Signature header, and using a new one for each key makes rotation painless.
Can I use this key with Google Workspace or Microsoft 365?: No. Both generate the DKIM key themselves and only give you a DNS record to publish. This generator is for servers and services where you supply the private key yourself.

Sources

Authentication and capacity are half of deliverability.

The other half is who you send to. Every hard bounce counts against the domain and inboxes you are sending from, and nothing in DNS can tell you which addresses on your list are dead.

Bulk verification with real SMTP mailbox checks
Hard bounces removed before a send, not discovered after
Catch-all, disposable and role detection on every row

Get started — $29.99/mo See the published limits first

One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.