DKIM Record Generator

Easily generate DKIM records by enter a selector and your domain name. Your public/private key pair is generated locally in your browser (or on our server if JavaScript is disabled) and we show you the corresponding DNS record.

What is DKIM

DKIM (DomainKeys Identified Mail) is an email authentication method that lets you cryptographically sign your outgoing messages. When a receiving mail server gets a signed message, it can verify that the email really came from your domain and was not modified in transit — protecting your recipients against spoofing and phishing that abuses your domain name.


It works with a key pair: your mail server keeps the private key secret and uses it to sign every outgoing message. The matching public key is published in your DNS as a TXT record, so anyone can look it up and verify the signature. That record lives at selector._domainkey.yourdomain.tld and carries the public key in its p= tag.


The selector is a short name you choose yourself, like default, mail, or service-x. It is stamped into the signature of every message and tells receiving servers which DNS record to look up — handy when you use several mail services, each with its own key. Just make sure the selector configured in your mail server matches the selector in the DNS record you create here.


This tool generates the key pair (RSA or Ed25519) for you and shows the exact DNS record to add. You can create as many selectors as you need. Note that DKIM is one piece of the puzzle: combine it with SPF (which lists the servers allowed to send for your domain) and DMARC (which tells receivers what to do with mail that fails the checks) for full protection.

Tip: Ed25519 keys are smaller and faster, but not all receiving mail servers support their verification yet. For maximum compatibility, publish an additional RSA 2048 key using a second selector (e.g., selector1 for Ed25519 and selector2 for RSA).

RSA 3072 and 4096 keys are less commonly used. RSA 2048 remains the recommended default, offering broad compatibility while keeping DNS records relatively short.

With JavaScript enabled, your keys are generated locally in your browser and nothing you type is sent to us. With JavaScript disabled, we only process your selector and domain in memory — we do not store or log any of it. You can also just fill in some random data, or skip the website entirely and do it locally with OpenSSL.

Generate the keys locally with OpenSSL

  1. Generate a private key

    Pick an algorithm. RSA 2048 is the most widely supported, Ed25519 is smaller and faster.

    RSA 2048

    openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem

    Ed25519

    openssl genpkey -algorithm ed25519 -out private.pem

  2. Extract the public key

    openssl pkey -in private.pem -pubout -out public.pem

  3. Convert the public key to Base64 for DNS

    RSA

    openssl pkey -pubin -in public.pem -outform DER | openssl base64 -A; echo

    Ed25519 (DNS expects only the raw 32-byte key)

    openssl pkey -pubin -in public.pem -outform DER | tail -c 32 | openssl base64 -A; echo

    Copy the output — you will need it in the next step.

  4. Publish the DNS TXT record

    RSA

    selector._domainkey.yourdomain.tld. IN TXT "v=DKIM1; k=rsa; p=YOUR_BASE64_KEY"

    Ed25519

    selector._domainkey.yourdomain.tld. IN TXT "v=DKIM1; k=ed25519; p=YOUR_BASE64_KEY"

    Replace selector with your DKIM selector (e.g. mail or default), yourdomain.tld with your domain, and YOUR_BASE64_KEY with the output from step 3. Keep private.pem secret — it goes into your mail server's DKIM signing config.

Privacy Policy