DKIM
GENERATOR
Generates a DKIM key pair using your browser cryptography, then formats the public half as the DNS TXT record to publish and hands you the private half to install on the mail server that signs your outbound email. The private key is created locally and is never transmitted, logged or stored.
Keys are created locally with the Web Crypto API. Once the TXT record is published, confirm the key resolves at your selector.
Check a published DKIM keyWhat is a DKIM Record Generator?
A DKIM record generator is a free tool that creates the cryptographic key pair used to sign outbound email and formats the public half as a DNS TXT record. The keys are generated in your browser with the Web Crypto API: you publish the public key at your selector and install the private key on the mail server that signs your mail.
How does a DKIM Record Generator work?
- 01Enter your domain and pick a selector, the label that identifies this key in DNS.
- 02We generate an RSA key pair with the Web Crypto API, entirely inside your browser.
- 03Publish the TXT record at selector._domainkey.yourdomain.com and load the private key into your mail server.
Frequently asked questions
What is a DKIM selector?
The selector is a label that lets one domain publish several DKIM keys at once, since the record lives at selector._domainkey.yourdomain.com. Mail servers put the selector in the signature header so receivers know which key to fetch. Any short name works; teams often use a date or a service name so keys can be rotated without downtime.
Is it safe to generate a private key in a browser?
The key pair here is produced by the Web Crypto API inside your own browser, and the private key never crosses the network, is never sent to us and is never stored. That said, for a production mail server the stronger practice is generating the key on the server itself, or in your provider control panel, so the private half never leaves the machine that will use it.
Should I use a 1024-bit or 2048-bit key?
Use 2048-bit. It is the current recommendation and every major receiver supports it. 1024-bit keys are still accepted but are considered weak, and some providers have started to distrust them. The only real constraint is that a 2048-bit public key makes a long TXT record, which a few older DNS panels need split into chunks.