DKIM Record & Key Generator

How it works

1. 1

   Choose a selector

   Pick a short label such as default or a date like 2026a. It becomes part of the record name and lets you rotate keys later.

2. 2

   Generate the key pair

   Click generate and the tool creates an RSA-2048 key pair in your browser using WebCrypto.

3. 3

   Publish and install

   Add the public key as a TXT record at <selector>._domainkey, and install the private key on your mail server.

Frequently asked questions

What is a DKIM selector?

A selector is a label that lets a domain hold several DKIM keys at once. It forms the record name: a selector of default publishes at default._domainkey.example.com. Using a new selector each time makes key rotation painless, since the old key keeps working until you remove it.

Are the keys really generated in my browser?

Yes. The key pair is created with the WebCrypto API on your own device, and neither the public nor the private key is uploaded. That is what makes it safe to generate a production key here. The page needs to be on a secure (https) origin for WebCrypto to run.

What do I do with the private key?

Install it on the mail server or service that sends your mail, following its DKIM configuration. Keep it secret and never publish it. Only the public key goes into DNS. If the private key is ever exposed, generate a new pair under a fresh selector and replace the record.

Why RSA-2048 and not a longer key?

RSA-2048 is the practical sweet spot for DKIM: it is strong and is supported everywhere, while its public key still fits comfortably in a single DNS TXT record. Larger RSA keys can overflow the 255-character TXT string limit and need awkward splitting.