# DKIM Record Generator: Create a DKIM Key Record

URL: https://email-validation.org/tools/dkim-generator/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

Paste the public key your mail server or provider gives you, or generate a new 2048-bit RSA key pair in this browser,
and get the TXT record to publish. Keys longer than 255 characters are shown as the quoted strings most DNS hosts
expect. The key pair is created with your browser's Web Crypto and is never sent to us.

## When you need this

Most hosted providers (Google Workspace, Microsoft 365, newsletter and transactional services) generate the key for
you and show the exact record or a CNAME to publish: use theirs. You need your own key pair when you sign mail
yourself, for example with OpenDKIM, Postfix, Exim or a mail library in your application.

## Publish it

1. Pick a selector: any short label, such as `s1` or `2026-11`. A new selector for every new key lets you rotate
   without downtime.
2. In your DNS host, add a **TXT** record with the host `<selector>._domainkey` and the record as its value. If your
   host asks for one value, paste the record as it is; if it shows quotes, use the quoted strings.
3. Install the private key on the signing server and configure it with the same selector and domain.
4. Check the published key with our [DKIM checker](https://email-validation.org/tools/dkim-checker/), then send a message and look for
   `dkim=pass` in its `Authentication-Results` header.

## Key size and type

Use RSA with 2048 bits: [RFC 8301](https://www.rfc-editor.org/rfc/rfc8301) requires at least 1024 bits and recommends
2048, and every receiver supports it. Ed25519 keys ([RFC 8463](https://www.rfc-editor.org/rfc/rfc8463)) are short and
strong, but not every receiver checks them yet: if you use one, sign with an RSA key as well.

## Generate a key with OpenSSL

If you prefer to create the key on the server itself:

```bash
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out dkim-private.pem
openssl pkey -in dkim-private.pem -pubout -outform DER | openssl base64 -A
```

The second command prints the public key as one base64 line: paste it above as the public key.

## Keep the private key safe

Anyone with the private key can sign mail as your domain. Store it only on the signing server, readable by the
signing process alone. If it leaks, publish a new key under a new selector, switch the signer to it, and then empty
the old record's `p=` to revoke it ([RFC 6376 §3.6.1](https://www.rfc-editor.org/rfc/rfc6376#section-3.6.1)).

Checking email addresses rather than domains? Try our [free email checker](https://email-validation.org/email-checker/) or see [pricing](https://email-validation.org/pricing/) for lists and the API.

## Frequently asked questions

### Is it safe to generate a DKIM key in the browser?

The key pair is created by your browser with Web Crypto and never sent to us. Copy the private key to your signing server and do not store it anywhere else. If you prefer, create it with openssl on the server instead.

### My DNS host rejects the long DKIM record. What do I do?

Long TXT values must be split into strings of up to 255 characters inside one record. Paste the quoted strings the generator shows; never create two separate records.

### What key size should I use?

RSA with 2048 bits. It is supported by every receiver and meets the recommendation of RFC 8301.