DKIM Key Generator

⚙ DNS & authentication

Generate a DKIM keypair in your browser — the private key for your server and the public key as a DNS record.

No sign-up required Runs on our own infrastructure Also available via API

Keys are generated locally in your browser with the Web Crypto API and never leave your device. For very long 2048-bit records your DNS provider may need the value split into 255-char strings — most panels do this automatically.

If you run your own mail server — Postfix with OpenDKIM, a self-hosted appliance, anything where the signing isn’t handled for you — you need a DKIM keypair to sign outgoing mail. Most hosted providers generate this for you and hand you a CNAME to publish. But when you control the mail server yourself, you have to create the keypair, keep one half secret, and publish the other half in DNS. This tool generates that keypair locally in your browser and formats the public half as a DNS record you can paste straight in.

What DKIM signing does

DKIM (DomainKeys Identified Mail, defined in RFC 6376) attaches a cryptographic signature to every message your server sends. Your server hashes selected headers and the body, encrypts that hash with the private key, and adds it as a DKIM-Signature: header. A receiver fetches the matching public key from your DNS, re-computes the hash, and confirms two things: the message wasn’t altered in transit, and it genuinely came from a domain that holds the private key. Because the signature travels with the message, DKIM survives forwarding — which is why it’s the more robust of the two ways to satisfy DMARC alignment.

Two keys, two very different homes

The whole security model rests on keeping the two halves separate:

  • The private key stays on your mail server and never leaves it. It’s the secret that lets your server — and only your server — produce valid signatures for your domain. Store it with tight file permissions, keep it out of version control, and never paste it into a form or email. Anyone who has it can sign mail as you.
  • The public key goes in DNS as a TXT record at <selector>._domainkey.yourdomain.com. It’s meant to be public — receivers read it to check signatures. It reveals nothing that helps an attacker.

The selector is just a label (e.g. vae2026, mail, s1) that lets one domain hold several keys at once — for rotation, or for separate mail streams. It appears in the s= tag of the signature and in the DNS record name.

Key length: use 2048-bit

DKIM keys here are RSA. Use 2048-bit. A 1024-bit key still works and is widely accepted, but it’s the floor, not a target — treat it as legacy. Don’t go below 1024: 512-bit keys are trivially breakable and rejected by many receivers. One practical wrinkle with 2048-bit keys is length — the public key is long enough that some DNS UIs need it split into multiple quoted strings within the single TXT record. They must concatenate back cleanly; a truncated or doubled record breaks verification, so copy the value exactly as generated.

Installing the keys

  1. Pick a selector and generate the keypair below.
  2. Install the private key in your mail server’s DKIM configuration for that selector — for OpenDKIM, that’s a key file referenced from your key table; for an ESP, paste it into their DKIM settings if they let you bring your own key.
  3. Publish the public key as the TXT record shown, at <selector>._domainkey.yourdomain.com. Wait for DNS to propagate.
  4. Send a test and read the receiving side’s Authentication-Results — you want dkim=pass with a d= that aligns to your From domain. Confirm the published key with the DKIM Checker or read the signature via the Header Analyzer.

Rotate keys periodically by generating a new selector, publishing it, switching signing over, and retiring the old record once no in-flight mail relies on it. To see DKIM alongside SPF, DMARC and the rest of your setup in one pass, run the Email Health Check.

Frequently asked questions

Is it safe to generate a DKIM key in a browser tool?
Yes — the keypair is generated locally with the Web Crypto API and the private key never leaves your browser. For maximum-security setups, some operators still prefer generating on the server itself with openssl.
Should I use a 1024-bit or 2048-bit DKIM key?
Use 2048-bit — it’s the modern recommendation. 1024-bit works but is the floor; never go below it. 512-bit is breakable and widely rejected.
Where does each key go?
The private key stays secret on your mail server; the public key is published as a TXT record at <selector>._domainkey.yourdomain.com. Verify it afterward with the DKIM Checker.
What if my TXT record is too long for my DNS provider?
Split it into multiple quoted strings within the single TXT record if your provider requires — they concatenate back into one value. Just don’t truncate or alter it, or DKIM verification fails.