Theme

Popular tools

DKIM Record Generator

Make a DKIM key pair in your browser and get the record to publish. On Google Workspace or Microsoft 365? They make the key: we show where.

Keys made with Web Crypto in your browser, never sent · RFC 6376, 8301 and 8463 · 20 senders' DKIM setups checked
DNS read from your browser

Looks for keys your domain already publishes and who made them. Or choose who signs your mail below.

Try

Built in your browser. Only DNS questions leave it, over HTTPS to Cloudflare's resolver (Google's as a second opinion).

Example

Generate a key for example.com

Made in your browser with Web Crypto. The private key never leaves this tab.

Who signs your mail?
Makes its own key
Takes your key
Uses your key
kKey type

What RFC 8301 asks for. The usual choice.

sSelector
._domainkey.example.com
A new name for every new key. Dated names say when it was made.
tRecord options
Advanced
Made in your browser with Web Crypto. The private key never leaves this tab.

Your key

Private key · Keep on your serverIsolated frame: no network, and no other script on this page can read it

Works offline: turn your Wi-Fi off and generate again.

Set up OpenDKIM

Key file
# Key file: only the opendkim user may read it
$ sudo mkdir -p /etc/opendkim/keys/example.com
$ sudo nano /etc/opendkim/keys/example.com/s.private
$ sudo chown -R opendkim:opendkim /etc/opendkim/keys
$ sudo chmod 600 /etc/opendkim/keys/example.com/s.private

Rotation plan

  1. TodayPublish , then start signing with it.
  2. In six monthsMake …, publish it beside .
  3. SwitchSign with ….
  4. 7 to 30 days laterKeep published for mail still in transit.
  5. RevokePublish an empty key at , don't delete it.v=DKIM1; k=rsa; p=

After you publish

Full check: example.comThe link carries these settings, never a key. Asked from your browser: Cloudflare's resolver, Google's as a second opinion.

How do I generate a DKIM key and record?

To create a DKIM record, make an RSA 2048 key pair, keep the private key on the server that signs your mail, and publish the public key as a TXT record at selector._domainkey.yourdomain (RFC 6376).

Pick a new selector name for every key, such as the month it was made, so the old key can stay published while mail signed with it is still on its way.

Then install the private key in your signer and send a test message: the DKIM-Signature header names the domain (d=) and selector (s=) receivers will look up.

Private keystays on your mail serversigns each message
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s202610; …
Public keypublished in DNSs202610._domainkey.example.comreceivers verify with it ✓
Two halves of one key
DKIM generator with an RSA 2048 private key kept in an isolated browser frame, the OpenDKIM files and a rotation planDKIM generator with an RSA 2048 private key kept in an isolated browser frame, the OpenDKIM files and a rotation planA private key no other script can readMade and kept in an isolated frame that can't reach the network.The form your signer readsPKCS#8, PKCS#1 or one line of base64, picked for your signer.Zero requests, and it works offlineA live count of network requests since you pressed Generate.Your signer's filesOpenDKIM, rspamd, Exim, Postfix or Amazon SES, with your domain and selector filled in.A dated selectorIts name says when the key was made; the rotation plan below dates the next key and the revocation.
An RSA 2048 key for OpenDKIM made with Web Crypto: the private key in an isolated frame with no network, the signer's files filled in, and the rotation plan with real dates.

Do I need to generate my own DKIM key?

Only if your own server signs your mail: Google Workspace, Microsoft 365 and most email services make the key themselves and show you the record to publish, so a key from any generator would never be used.

Your own key matters for Postfix with OpenDKIM, rspamd, Exim, Haraka, your own app, and services that accept one, like Amazon SES (BYODKIM) and Mailgun.

SenderKey made byYou publishSelectors
Google Workspacethe providerTXT (their key)google
Microsoft 365the providerCNAMEs to their keysselector1, selector2
SendGridthe providerCNAMEs to their keyss1, s2
Mailchimpthe providerCNAMEs to their keysk2, k3
Postmarkthe providerTXT (their key)<date>pm
Brevothe providerCNAMEs to their keysbrevo1, brevo2
Zoho Mailthe providerTXT (their key)zoho
Amazon SESeitherTXT (your key)any
MailguneitherTXT (your key)any
OpenDKIMyouTXT (your key)any
rspamdyouTXT (your key)any
EximyouTXT (your key)any
Who makes the key

What's in a DKIM record?

A TXT record at selector._domainkey.domain holding v=DKIM1, the key type k= and the public key p=; optional tags limit the hashes (h=) or services (s=) or mark the key as testing (t=).

A DKIM record example: v=DKIM1; k=rsa; p=MIIBIjANBgkqh… (the key runs on for about 400 characters). An empty p= means the key is revoked. RSA keys are published as a SubjectPublicKeyInfo, which OpenDKIM and rspamd require; Ed25519 keys as the raw 32 bytes.

s202610._domainkey.example.com · TXT
v=DKIM1; k=rsa; h=sha256; s=email; p=MIIBIjANBgkqhkiG9w0BAQ…GQIDAQAB
TagMeaningDefault
vVersion, first if presentDKIM1
kKey type: rsa or ed25519rsa
hHashes allowedall
sServices: email or **
ty = testing, s = exact domainnone
nNotes for peoplenone
pThe public key; empty = revokedrequired
A DKIM record, tag by tag

RSA 1024, 2048, 4096 or Ed25519?

Use RSA 2048: 1024 is the minimum receivers accept, 4096 strains DNS, and Ed25519 is short but independent tests found the big mailbox providers don't verify it, so it only helps beside an RSA signature.

Many tools still default to 1024: opendkim-genkey, rspamd's dkim_keygen and Microsoft 365. RFC 8301 asks for 2048.

If you add Ed25519, sign with RSA too, under a second selector; Yahoo may not pass DMARC when one of several aligned signatures fails.

RSA 1024234 characters · 1the minimum
RSA 2048410 characters · 2recommended
RSA 3072582 characters · 3check your signer
RSA 4096754 characters · 3may not fit UDP
Ed2551966 characters · 1not verified by the big providers

255-byte strings: 255, 510, 765

Record length per key type

How do I set up OpenDKIM, rspamd or Exim?

Store the private key where only the signer can read it, map your domain and selector to it in the signer's config, and restart; the tabs show each signer's files with your names filled in.

Check the result by sending yourself a message and reading its DKIM result in the headers, or with our DKIM checker.

OpenDKIM · KeyTable · SigningTable
# /etc/opendkim/KeyTable
s202610._domainkey.example.com example.com:s202610:/etc/opendkim/keys/example.com/s202610.private

# /etc/opendkim/SigningTable
*@example.com s202610._domainkey.example.com

# /etc/opendkim/TrustedHosts
127.0.0.1
localhost
Rspamd · dkim_signing.conf
# /etc/rspamd/local.d/dkim_signing.conf
domain {
  example.com {
    selector = "s202610";
    path = "/var/lib/rspamd/dkim/example.com.s202610.key";
  }
}
# only if example.com is a subdomain: use_esld = false;
# only if users log in without @example.com: allow_username_mismatch = true;

$ sudo rspamadm configtest && sudo systemctl restart rspamd
Your signer's files

Why is my DKIM record split into several strings?

A 2048-bit key record is about 410 characters, longer than one 255-byte TXT string, so DNS stores it as two strings that verifiers join with nothing between them.

Cloudflare, Azure and cPanel-style panels take the whole value and split it; Route 53 and Google Cloud DNS want you to paste the quoted strings. GoDaddy caps a value at 1,024 characters.

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtw0DwsqwlKexAE5H5WDgWwJlEz/C+7FIeL9/Y1TahjkvMvvX+lUQofjxhVmt/yMXVjvgrYb9jZIxtG96iO9qggOWi0vAeClBst4m3rj3O7GjkC/dfbG2BhQBpwJYt6ec76B8y6cyHBZ0+hMWGfAxuLQt/kkiVsaqwRxRQvEuMfnL4L9S8I7evV8GHFihlEgIaM9W8ag4zzL0ZxiEeznDaHYmJDbmgzarExXIY1IuMdpPu1/GmSrq9RCHEifKVvKsOPcmbv2u6xMbW63/EZmPIY78eZRqkioT8TangIPKsP7HEFZRKQwnQJy/OybqexdiFmt29BXBo7A745shhzueGQIDAQAB
1255 B2155 B
s202610._domainkey.example.com. 3600 IN TXT ( "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtw0DwsqwlKexAE5H5WDgWwJlEz/C+7FIeL9/Y1TahjkvMvvX+lUQofjxhVmt/yMXVjvgrYb9jZIxtG96iO9qggOWi0vAeClBst4m3rj3O7GjkC/dfbG2BhQBpwJYt6ec76B8y6cyHBZ0+hMWGfAxuLQt/kkiVsaqwRxRQvEuMfnL4L9S8I7evV8GHFihlEgIa"
	"M9W8ag4zzL0ZxiEeznDaHYmJDbmgzarExXIY1IuMdpPu1/GmSrq9RCHEifKVvKsOPcmbv2u6xMbW63/EZmPIY78eZRqkioT8TangIPKsP7HEFZRKQwnQJy/OybqexdiFmt29BXBo7A745shhzueGQIDAQAB" )
A 2048-bit record, as DNS stores it

How do I rotate DKIM keys?

Publish a new key under a new selector, switch signing to it, keep the old record 7 to 30 days for mail still in transit, then revoke it with an empty p=; M3AAWG says rotate at least every six months.

Revoke rather than delete, so verifiers report the old selector as revoked. Never reuse a selector name for a new key.

NovDecJanFebMarAprMayJunJul
s202611signskept 7–30 daysp= (revoked)
s202705signs
Two selectors, one handover

Is it safe to generate a DKIM key online?

Only if the key is made in your browser and never sent: this page makes it with Web Crypto inside an isolated frame that can't reach the network, which you can confirm in your browser's developer tools.

Some online generators make the key on their server and send it back in the response, where it could be logged or kept. A key made in your browser exists only in your tab until you save it.

No other script on this page can read the frame that holds the key, and the page works offline: turn your Wi-Fi off and generate again.

Made in your browserisolated frameworks offline0network requests
Made on a serverGET /generate?key_size=2048200 {"private_key": "-----BEGIN…"}can be logged
Where the private key travels

DKIM Record Generator FAQ

What is a DKIM record?

A DKIM record is a TXT record at selector._domainkey.yourdomain that publishes the public half of a key pair. Your mail server signs each message with the private half, and receivers fetch the public key to check that the message really came from your domain and wasn't changed on the way. It's defined in RFC 6376.

Is it safe to generate DKIM keys here?

Yes. This DKIM key generator makes the key pair with Web Crypto in your browser, inside an isolated frame that has no network access, and no other script on the page can read it. Nothing is sent: you can watch the network tab in your browser's developer tools stay empty, or turn your connection off and generate again.

Which key size should I use?

RSA 2048. RFC 8301 asks signers for at least 2048 bits, Gmail and Yahoo recommend it, and its record fits most DNS hosts as two strings. 1024 is the minimum receivers accept; use it only if your DNS host can't take long values. 4096 makes a long record that may not fit a plain DNS answer.

Do I need a DKIM key for Google Workspace or Microsoft 365?

No. Google Workspace makes the key in the Admin console and shows you a TXT record for google._domainkey; Microsoft 365 signs with keys behind two CNAME records, selector1 and selector2. A key from any generator would never be used. Choose your sender in the generator to see exactly what to publish.

What is a DKIM selector?

A selector is the name in front of ._domainkey that tells receivers which key to fetch, such as s202610 in s202610._domainkey.example.com. It lets one domain have several keys at once, one per server, service or date. The generator suggests a dated selector, so each new key gets a new name and rotation is easy.

What format is the private key?

PKCS#8 PEM (BEGIN PRIVATE KEY) by default, which OpenDKIM, rspamd and Exim read. You can switch to PKCS#1 (BEGIN RSA PRIVATE KEY), the traditional form some tools document, or one line of base64 without header or line breaks, which Amazon SES BYODKIM asks for. Save it with permissions only the signer can read.

Can a domain have more than one DKIM record?

Yes, under different selectors: each service that signs your mail can have its own, and a rotation briefly has two of yours. One selector name must hold only one TXT record, though; two records at the same name make the result undefined, and verifiers may pick either one.

Why is my DKIM record longer than 255 characters?

A 2048-bit RSA public key is 392 characters of base64, so the whole record is about 410. A TXT string holds at most 255 bytes, so DNS stores it as two strings, and verifiers join them with nothing in between. Most DNS hosts split it for you; Route 53 and Google Cloud DNS need the quoted strings.

What does t=y mean in a DKIM record?

t=y marks the key as in testing: verifiers must treat mail signed with it exactly like unsigned mail, even when the signature fails. Use it while you check your setup, then remove it, because a testing key gives DMARC nothing. t=s is different: it requires the signature's identity to use exactly your domain, not a subdomain.

How often should I rotate DKIM keys?

At least every six months, as M3AAWG recommends. Publish the new key under a new selector, switch your signer to it, and keep the old record for 7 to 30 days while signed mail is still in transit. Then revoke the old selector by publishing it with an empty p=, rather than deleting it.

Missing something?Suggest a feature or a new tool

Related tools