DKIM Generator
DKIM Key Generator
Common selectors: default, mail, dkim, google, k1. You can use any value.
✅ Best balance of security and performance
📖 What is DKIM?
DKIM (DomainKeys Identified Mail) adds a digital signature to your emails, proving they haven't been tampered with in transit.
- The private key signs outgoing emails (installed on your mail server)
- The public key verifies signatures (published in DNS)
- Receiving servers check the signature against your DNS record
About DKIM Generator
Generate an RSA-2048 DKIM key pair in your browser. You get the public key formatted as a DNS TXT record (ready to publish at selector._domainkey.yourdomain.com) plus the private key for your mail server. The key generation runs entirely client-side — your private key never leaves your browser. Includes a selector picker so you can rotate keys safely later without disrupting existing signing.
How the DKIM generator works
Generate, publish, sign
Generate a key pair
In-browser RSA-2048 key generation via Web Crypto API. Private key never transmitted to a server. Public key formatted as p= tag.
Publish public key in DNS
Add a TXT record at selector._domainkey.yourdomain.com with the v=DKIM1; k=rsa; p=... value. Most DNS providers handle long records automatically.
Install private key on mail server
Drop the private key into your mail server config (Postfix, Exim, Mailgun, SendGrid, etc.). Mail server signs outgoing messages with the key.
Common gotchas this generator avoids
DKIM mistakes that break signing
Using RSA-1024 instead of RSA-2048
Many receivers no longer accept signatures from 1024-bit keys. The generator defaults to 2048-bit which is the current standard.
TXT record split incorrectly
Long DKIM TXT records often exceed 255 chars and must be split into multiple strings. Some DNS providers concatenate wrong. Verify with our DKIM Checker after publishing.
Publishing public key with extra whitespace
p= tag contains base64 with no whitespace. Adding line breaks or spaces breaks the public key. The generator outputs clean, single-line format.
Wrong selector path
Publish at "selector._domainkey.yourdomain.com" — NOT "selector.yourdomain.com" or "_domainkey.yourdomain.com". The generator labels DNS path correctly.
Reusing a selector across rotations
When rotating keys, use a NEW selector. Don't overwrite the old one immediately — in-flight messages signed with the old key still need to verify.
Storing the private key insecurely
Private keys must be stored with read-only access for your mail server user (chmod 600). World-readable private keys = anyone can sign as your domain.
FAQ
DKIM generator — common questions
What is a DKIM key pair?+
Should I use RSA-1024 or RSA-2048?+
What is a DKIM selector?+
How do I install the private key on my mail server?+
How often should I rotate DKIM keys?+
Other generators
Build your full email auth stack
Beyond Free Tools
Enterprise Cloud & IT Services
From Microsoft 365 migrations to fully managed infrastructure — we handle every layer of your IT stack.
Migration Tools We Use
Enterprise-grade tooling for every platform
- BitTitan MigrationWiz— Cloud-to-cloud email & data
- Microsoft Exchange Hybrid— On-prem to Exchange Online
- ShareGate Desktool— SharePoint & OneDrive
- Microsoft Mover.io— Google Drive to OneDrive
- Entra ID Connect— AD sync & hybrid identity
- PowerShell & EWS API— Automation & bulk ops