DKIM Key Generator
Create a DKIM key pair and the exact DNS record to publish, right in your browser. The private key is generated on your device and never sent anywhere.
Keys are created in your browser with its built-in cryptography and are never sent anywhere.
Do you need this tool?
Probably not if you use Google Workspace, Microsoft 365, Zoho or an email marketing service. They create the DKIM key for you: you just copy the DNS record they give you from their admin panel.
Use this tool if you run your own mail server (Postfix with OpenDKIM or Rspamd, Exim, Haraka and others) or a script that signs its own mail. Generate the pair, publish the public key in DNS, and point your signing software at the private key with the same selector.
How to use the DKIM Key Generator
- Enter your domain and choose a selector name, such as mail or a date like s2026.
- Leave the key size at 2048-bit.
- Press Generate keys.
- Publish the public record as a TXT record at the host shown.
- Download the private key and configure your mail server to sign with it using the same selector.
Setting up DKIM on your own server
OpenDKIM (with Postfix): place the private key file on the server, add the domain, selector and key path to the KeyTable and SigningTable, then restart OpenDKIM and Postfix.
Rspamd: add the key path and selector to the DKIM signing module settings.
After publishing the DNS record, use the Email DNS Lookup on this site with dkim:yourdomain.com:selector to confirm it's live, then send a test to a Gmail address and check "Show original" for DKIM: PASS.
Rotating keys
Change your DKIM key every 6 to 12 months. Generate a new pair with a new selector, publish the new public key, switch your server to the new selector, and remove the old record a week later so mail already in transit still verifies.
Related free tools
Frequently asked questions
What key size should I use?
2048-bit. 1024-bit keys are considered weak and some receivers distrust them; 4096-bit keys work but make a very long DNS record that some DNS hosts struggle with.
What is a DKIM selector?
A name that lets you publish several DKIM keys for one domain, for example "mail" or "s2026". The record lives at selector._domainkey.yourdomain.com, and your mail server signs with the same selector.
Is it safe to generate keys in a browser?
Yes. Keys are created by your browser's built-in cryptography and never leave your device. Save the private key securely and never share it.
I use Google Workspace or Microsoft 365. Do I need this?
No. Those services generate the key for you; copy the DNS record from their admin panel instead.
Can I reuse the same key on several servers?
Yes, if they all sign for the same domain and selector, but giving each system its own selector makes it easier to replace one key without affecting the others.
My DNS host rejects the long record. What now?
Use the 255-character chunks version, or choose a 1024-bit key as a last resort.