DKIM key and record generator

Generate a DKIM key pair for your mail server, and the DNS record to publish.

Keys are created by your browser’s built-in cryptography – the private key is never sent to our servers.

Using Microsoft 365, Google Workspace or an email service? They create DKIM keys for you – turn DKIM on in their settings and publish the records they show (Microsoft 365 uses two CNAME records, selector1._domainkey and selector2._domainkey; Google uses a TXT record at google._domainkey). This generator is for your own mail servers, or services that ask you to supply a key.

Domain

Selector

Any name – using the date makes rotating keys easier.

Key size

Testing mode (t=y) – receivers treat failures as if the message was unsigned

1. Publish the DNS record

Add a TXT record named:

with the value:

Click a value to copy it. If your DNS provider asks for separate strings (for example, BIND zone files), use:

2. Install the private key on your mail server

Keep this secret – anyone with it can sign email as your domain. It won’t be shown again once you leave this page.

For OpenDKIM, add the key to your KeyTable and SigningTable using the selector ; for Postfix with rspamd, use the key as /var/lib/rspamd/dkim/.key.

3. Check it

Once the record is published (DNS changes can take a while), check it with our DNS record checker, then send a test email and look at the DKIM result in the header analyzer.

A free tool provided by Auth-Email

Auth-Email makes your Gmail, Outlook, or other OAuth 2.0 email account available to any IMAP, POP3, or SMTP email client — no app passwords or special configuration needed.

Read the docs Try Auth-Email →

Frequently asked questions

Should I generate my own DKIM key?
Only if you run your own mail server, or your provider asks you to supply a key. Microsoft 365, Google Workspace and most email services create DKIM keys for you – you just publish the records they give you.

Is the private key sent to your servers?
No. The key pair is generated by your browser’s built-in cryptography, and the private key is only saved when you download it. Keep it secret – anyone with it can sign email as your domain.

Which key size should I use?
2048-bit RSA keys are the standard choice. 1024-bit keys are considered weak, and some DNS providers have trouble with 4096-bit keys because of their length.