DKIM Record Generator

A DKIM record generator creates the key pair that lets a mail server sign outgoing email, and the DNS TXT record that lets receivers check those signatures. Our free tool generates a 2048-bit RSA key in your browser with the Web Crypto API, then gives you the selector._domainkey record with the correct p= value, a version split into 255-character strings for DNS hosts that need it, and the private key in PEM format. The private key never leaves your device. Before you start, check whether your email provider already creates DKIM keys for you, because most do.

How to use the DKIM generator

1. 1 Check you need your own keyIf you use Google Workspace, Microsoft 365 or a hosted email service, use the DKIM settings in its admin panel instead. This tool is for self-hosted mail servers.
2. 2 Enter your domain and selectorType the domain you send from and a selector, a short label for this key such as mail202610.
3. 3 Generate the key pairKeep the recommended 2048-bit size unless your DNS host truly cannot store a long record, then click Generate key pair.
4. 4 Publish the DNS recordCreate a TXT record at selector._domainkey with the value shown. Use the split version if your DNS host rejects long strings.
5. 5 Install the private key and testSave the private key to your mail server, configure signing, then check the record with our DKIM checker and send a test email.

Do you actually need to generate a DKIM key?

For most businesses, the answer is no. Google Workspace, Microsoft 365, Zoho Mail, Fastmail and almost every hosted email service generate the DKIM key pair themselves, keep the private key on their servers and show you the DNS record to publish. Newsletter and transactional email platforms such as Mailchimp, Brevo, Postmark and Amazon SES work the same way, often using CNAME records that point to keys they manage and rotate.

A key generated anywhere else will not work with those services, because they sign your email with their own private key. If you publish a record from this tool for a domain that sends through Google or Microsoft, nothing will improve, and you may confuse whoever looks after your email later.

You need your own key when you run the mail server yourself, for example Postfix with OpenDKIM or rspamd, Exim, Mail-in-a-Box or a similar setup on a VPS, or when an application or appliance asks you to paste in a private key it will sign with. In those cases this generator saves you installing OpenSSL or running command-line tools.

How DKIM signing works

DKIM, short for DomainKeys Identified Mail, adds a digital signature to the headers of every message your server sends. The server creates the signature with a private key that only it holds. The receiving server reads the d= domain and s= selector from the signature, looks up the matching public key in DNS at selector._domainkey.yourdomain, and checks that the signature is valid.

If the check passes, the receiver knows two things: the message was signed by a server trusted by that domain, and the signed parts were not changed in transit. A DKIM pass for your own domain is also one of the two ways a message can pass DMARC, alongside SPF, and it survives forwarding much better than SPF does.

The selector is simply a label that lets one domain publish several keys at once. That is how different services, or old and new keys during a change-over, can sign mail for the same domain without clashing.

Understanding the DNS record

The record you publish is a TXT record at the name selector._domainkey under your domain. Its value is a list of tags separated by semicolons.

• v=DKIM1: the version. It must come first and is always DKIM1.
• k=rsa: the key type. RSA is supported by every receiver.
• p=: the public key, base64 encoded. This is the long string. A 2048-bit key produces a value of around 400 characters.
• t=y: optional testing flag that tells receivers you are still setting DKIM up. Remove it once signing works.
• Name: most DNS panels add your domain automatically, so you enter only selector._domainkey. Entering the full name in such a panel creates selector._domainkey.example.co.uk.example.co.uk, a very common mistake.

Why long DKIM records are split into 255-character strings

DNS stores a TXT record as one or more character strings, and each string can hold at most 255 characters. A 2048-bit DKIM record is longer than that, so it has to be stored as two strings. Receivers join the strings back together, with nothing in between, before reading the key.

Many DNS hosts, including Cloudflare and most UK registrar control panels, accept the long value in a single box and split it for you behind the scenes. Others, such as AWS Route 53, Azure DNS and BIND zone files, expect you to supply the strings yourself, each in its own quotation marks, separated by a space. The tool gives you both versions and a BIND zone file line, so copy whichever matches your provider.

If you paste the quoted version into a panel that expects a single value, the quotation marks may become part of the record and break it. After publishing, look the record up with our DKIM checker: it should show one continuous key with no stray quotes or spaces.

Key size: 2048-bit or 1024-bit?

Use 2048-bit keys. They are the current recommendation from the DKIM standards and major mailbox providers, and every mainstream receiver supports them. 1024-bit RSA keys are no longer considered strong enough for long-term use, and keys that short have been publicly cracked in the past to forge signatures.

The only reason to choose 1024-bit is a DNS host that cannot store a TXT record longer than 255 characters at all. That is rare now. If you are stuck with one, use 1024-bit as a stopgap and plan to move your DNS to a provider that supports longer records.

This tool does not offer 4096-bit keys because the record becomes too long for many DNS hosts and some receivers, with no practical benefit for email today. Whatever size you choose, rotate keys from time to time, for example once or twice a year, by publishing a new selector, switching the server to it, and removing the old record a few days later.

Keeping the private key safe

The private key is what lets a server sign email as your domain. Anyone who obtains it can send messages that pass DKIM checks, which makes phishing in your name far more convincing. Treat it like a password for your whole domain.

This generator creates the key pair inside your browser using the Web Crypto API, the same cryptography your browser uses for secure websites. Nothing is sent to our servers, logged or stored, and the key disappears when you refresh or leave the page. Download the key file and copy it straight to your mail server, then delete the downloaded copy. Do not send it by email, chat or support ticket.

On the server, make the key readable only by the signing service, for example with chmod 600 and ownership set to the opendkim user. The tool offers the key in the modern PKCS#8 format and the traditional PKCS#1 RSA format; OpenDKIM, rspamd and Exim accept either. If a key is ever exposed, generate a new one under a new selector straight away and remove the old DNS record.

Examples you can copy

Name:  mail202610._domainkey.example.co.uk
Type:  TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...IDAQAB

mail202610._domainkey.example.co.uk. 3600 IN TXT (
  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
  "...remaining characters of the key...IDAQAB" )

Common mistakes to avoid

Frequently asked questions