DKIM Generator
Generate a DKIM key pair: a fresh RSA private key for your mail server and the matching DNS TXT record to publish under your selector. Keys are never stored.
Frequently asked questions
What does a DKIM generator do?
It creates the two halves of a DKIM key: a private key your mail server signs outgoing messages with, and the public key published in DNS so receivers can verify the signature. This one makes an RSA keypair and formats the public half as a ready-to-paste TXT record.
Where do I publish the DKIM record?
As a TXT record named selector._domainkey.yourdomain.com, where selector is the name you entered (mail, s1, 2026q4). The mail server must sign with the same selector, it goes into the DKIM-Signature header so receivers know which key to fetch.
Should I use a 1024-bit or 2048-bit DKIM key?
2048-bit. 1024-bit keys are considered weak and some receivers already rate them lower. Use 1024 only if your DNS host cannot store a TXT value longer than 255 characters; most split the long value into several strings automatically.
Should I generate DKIM keys here or with my email provider?
If you send through Google Workspace, Microsoft 365 or an ESP, use the key they generate: they hold the private key and sign for you. This generator is for servers you run yourself (Postfix, Exim, an app server). For production, generating the key on that server is safer still.
How do I check the DKIM record after publishing it?
Run the domain and selector through the DKIM Checker. It fetches the TXT record, validates its tags and reports the key size, or tells you the selector is missing.