DKIM record generator

v=DKIM1; k=rsa; p=

Paste the public key your mail server or provider gives you, or generate a new 2048-bit RSA key pair in this browser, and get the TXT record to publish. Keys longer than 255 characters are shown as the quoted strings most DNS hosts expect. The key pair is created with your browser's Web Crypto and is never sent to us.

When you need this

Most hosted providers (Google Workspace, Microsoft 365, newsletter and transactional services) generate the key for you and show the exact record or a CNAME to publish: use theirs. You need your own key pair when you sign mail yourself, for example with OpenDKIM, Postfix, Exim or a mail library in your application.

Publish it

1. Pick a selector: any short label, such as s1 or 2026-11. A new selector for every new key lets you rotate without downtime.
2. In your DNS host, add a TXT record with the host <selector>._domainkey and the record as its value. If your host asks for one value, paste the record as it is; if it shows quotes, use the quoted strings.
3. Install the private key on the signing server and configure it with the same selector and domain.
4. Check the published key with our DKIM checker, then send a message and look for dkim=pass in its Authentication-Results header.

Key size and type

Use RSA with 2048 bits: RFC 8301 requires at least 1024 bits and recommends 2048, and every receiver supports it. Ed25519 keys (RFC 8463) are short and strong, but not every receiver checks them yet: if you use one, sign with an RSA key as well.

Generate a key with OpenSSL

If you prefer to create the key on the server itself:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out dkim-private.pem
openssl pkey -in dkim-private.pem -pubout -outform DER | openssl base64 -A

The second command prints the public key as one base64 line: paste it above as the public key.

Keep the private key safe

Anyone with the private key can sign mail as your domain. Store it only on the signing server, readable by the signing process alone. If it leaks, publish a new key under a new selector, switch the signer to it, and then empty the old record's p= to revoke it (RFC 6376 §3.6.1).

Checking email addresses rather than domains? Try our free email checker or see pricing for lists and the API.