Home / Deliverability and DNS records / DKIM key generator

DKIM Key Generator

Create a DKIM key pair and the exact DNS record to publish, right in your browser. The private key is generated on your device and never sent anywhere.

Keys are created in your browser with its built-in cryptography and are never sent anywhere.

Do you need this tool?

Probably not if you use Google Workspace, Microsoft 365, Zoho or an email marketing service. They create the DKIM key for you: you just copy the DNS record they give you from their admin panel.

Use this tool if you run your own mail server (Postfix with OpenDKIM or Rspamd, Exim, Haraka and others) or a script that signs its own mail. Generate the pair, publish the public key in DNS, and point your signing software at the private key with the same selector.

How to use the DKIM Key Generator

  1. Enter your domain and choose a selector name, such as mail or a date like s2026.
  2. Leave the key size at 2048-bit.
  3. Press Generate keys.
  4. Publish the public record as a TXT record at the host shown.
  5. Download the private key and configure your mail server to sign with it using the same selector.

Setting up DKIM on your own server

OpenDKIM (with Postfix): place the private key file on the server, add the domain, selector and key path to the KeyTable and SigningTable, then restart OpenDKIM and Postfix.

Rspamd: add the key path and selector to the DKIM signing module settings.

After publishing the DNS record, enter your domain and selector in the free DMARC, SPF, DKIM & MX checker to confirm it's live, then send a test to a Gmail address and check "Show original" for DKIM: PASS.

Rotating keys

Change your DKIM key every 6 to 12 months. Generate a new pair with a new selector, publish the new public key, switch your server to the new selector, and remove the old record a week later so mail already in transit still verifies.

Related free tools

What the DKIM key generator does

This tool creates a DKIM key pair for your domain: a public key you publish in DNS and a private key your mail server uses to sign outgoing email. It also shows the exact TXT record name and value to add, so you do not have to work out the format yourself. It is meant for people who run their own mail server or sending script.

Benefits

  • Ready-to-paste DNS recordYou get the record type, the host name (selector._domainkey.yourdomain) and the full value starting with v=DKIM1, each ready to copy.
  • Choice of key sizePick 2048-bit, which is the recommended size, or 1024-bit or 4096-bit if your setup needs it.
  • Help for strict DNS hostsIf your DNS provider will not accept one long value, copy the record split into quoted chunks of 255 characters or fewer.
  • Private key as a fileDownload the private key as a standard .pem file named after your selector and domain, or copy it to your clipboard.
  • Your own selector nameUse any selector you like, such as mail or a date like s2026, which makes it easy to run several keys or rotate them later.
  • Built-in input checksThe tool warns you if the selector or domain is not in a valid format before it creates anything.
  • Generate again any timePress the button again to create a fresh pair, for example when you rotate keys.

Who it is for

  • A system administrator running Postfix with OpenDKIM or Rspamd who needs a new signing key.
  • A developer whose app or script sends email directly and must sign it with DKIM.
  • An IT person rotating an old DKIM key and setting up a new selector.
  • A web developer helping a client fix email that fails DKIM checks on a self-hosted server.
  • A hobbyist running a mail server for a personal domain.

How to use it

  1. Enter your domain and a selector name.
  2. Keep the key size at 2048-bit unless your DNS host needs something else.
  3. Press Generate keys.
  4. Add the TXT record at the host name shown, using the copied value.
  5. Download or copy the private key right away and set up your mail server to sign with the same selector.

Your privacy

The keys are created by your browser's built-in cryptography on your own device. The private key is not uploaded or stored by the site, so save it before you leave the page.

Frequently asked questions

What key size should I use?

2048-bit. 1024-bit keys are considered weak and some receivers distrust them; 4096-bit keys work but make a very long DNS record that some DNS hosts struggle with.

What is a DKIM selector?

A name that lets you publish several DKIM keys for one domain, for example "mail" or "s2026". The record lives at selector._domainkey.yourdomain.com, and your mail server signs with the same selector.

Is it safe to generate keys in a browser?

Yes. Keys are created by your browser's built-in cryptography and never leave your device. Save the private key securely and never share it.

I use Google Workspace or Microsoft 365. Do I need this?

No. Those services generate the key for you; copy the DNS record from their admin panel instead.

Can I reuse the same key on several servers?

Yes, if they all sign for the same domain and selector, but giving each system its own selector makes it easier to replace one key without affecting the others.

My DNS host rejects the long record. What now?

Use the 255-character chunks version, or choose a 1024-bit key as a last resort.