Free tool · no signup

DKIM record generator

Create a DKIM key pair in your browser and get the exact DNS record to publish, plus the private key for your mail server. The key never leaves your device.

By the Bug Circuit security team · Last updated November 4, 2026

Your settings

Your domainThe domain you send mail from, such as yourcompany.com.SelectorA short label for this key, for example s2026. Use a new one each time you rotate, and a different one for each service that signs your mail.Key size2048 bits is the standard choice.Mark the key as testing (t=y) while I roll it out

The key is created in this browser with the Web Crypto API. Nothing is sent to us, stored, or logged.

Press the button to create a key pair. You will get the DNS record to publish at s2026._domainkey and the private key for your mail server.

What is DKIM? A digital signature on your outgoing email. Your mail server signs each message with a private key, and receivers check it with the public key you publish in DNS. If you use Google Workspace, Microsoft 365 or another email service, use the record they give you. This tool is for mail servers you run yourself.

How it works

How DKIM works

When your server sends a message, it adds a DKIM-Signature header: a signature over selected headers and the body, made with a private key. The header names a domain (d=) and a selector (s=). The receiving server looks up the public key in DNS at selector._domainkey.domain, verifies the signature and learns that the message really passed through a system that holds your key and was not changed on the way.

The selector lets you have several keys at once. Use a different selector for each service that signs mail for you, and a new one each time you rotate a key, so the old one can stay published until mail signed with it has been delivered.

When to use this tool, and when not to

Google Workspace, Microsoft 365, Mailchimp, SendGrid and most other email services create the key pair for you and show you the DNS record. Use theirs: their servers hold the private key, and a record from this tool would not match it. This generator is for a mail server you run, such as Postfix with OpenDKIM or a self-hosted mail suite, or a custom application that signs its own mail.

The private key is created with the Web Crypto API inside your browser tab. It is not sent to us, stored or logged. Copy it straight to your mail server, then close the page. Never publish it or commit it to a repository.

Key size and long records

Use 2048 bits. A 1024-bit key is considered weak, and receivers must accept keys up to 4096 bits (RFC 8301). A 2048-bit public key makes a TXT record of about 410 characters. DNS limits each string to 255 characters, so the record is published as two quoted strings that receivers join together. Most DNS dashboards do this for you when you paste the whole value, and the tool shows the split form for zone files.

DKIM is one of three checks. It proves the message was signed, SPF says which servers may send, and DMARC tells receivers what to do when they disagree. Set up all three, then test with the email spoofing checker.

Worked examples

The record to publish

Domain example.com, selector s2026, 2048 bits.

Name:  s2026._domainkey.example.com
Type:  TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

The p= value is the whole public key on one line. The tool prints the real one for the key it just made.

The same record in a zone file

The value is longer than 255 characters, so it is split into two strings.

s2026._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq...(first 255 characters)" "...(the rest)"

Receivers join the strings with nothing between them. Do not add a space or a line break inside the key.

Rotating a key

You used selector s2026 and want a new key in 2027.

Publish s2027._domainkey.example.com, switch the mail server to sign with s2027,
then remove s2026._domainkey.example.com a few weeks later.

Rotating once a year is a reasonable habit. Keeping the old record for a while means mail that is still in transit keeps verifying.

Frequently asked questions

Is it safe to generate a DKIM key in a web page?

The key is made by your own browser with the Web Crypto API and is never sent anywhere. You can check by switching off your network connection after the page loads: it still works. If you still prefer, you can make a key on your server with OpenDKIM's opendkim-genkey or with the openssl command.

What selector should I use?

Any short label made of letters, numbers, hyphens and dots, such as s2026 or mail1. Use a different one per sending service and a new one at each rotation.

Do I still need SPF and DMARC?

Yes. DKIM proves a message was signed, SPF lists the servers allowed to send, and DMARC tells receivers what to do when the checks fail or do not match your From domain. Together they stop most spoofing.

My DNS host says the record is too long. What now?

Paste the value as one string first, because many hosts split it for you. If it refuses, add it as two quoted strings of at most 255 characters each, exactly as shown in the zone-file form. As a last resort, create a 1024-bit key, but only if your host truly cannot store the longer record.

How do I check that DKIM works?

Send a message to a Gmail address, open it, choose Show original and look for dkim=pass in the Authentication-Results header. You can also run the email spoofing checker on your domain.

Where does the private key go?

On the server that signs your mail. With OpenDKIM it is the file named in your KeyTable. Some software wants the older RSA PRIVATE KEY format, and you can convert the key with: openssl rsa -in key.pem -traditional -out key-rsa.pem

Should I use an Ed25519 key instead?

Ed25519 DKIM keys are defined in RFC 8463, but support among receivers is not universal, so a mail signed only with one may fail to verify. RSA 2048 is the safe default. Publishing both is possible but rarely needed.

Keep reading

Email Spoofing CheckerTest SPF, DKIM and DMARC for your domain.SPF Record GeneratorList who may send mail as your domain.DMARC Record GeneratorTell receivers what to do when checks fail.DNS Record LookupSee the records you published.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing