DKIM Record & Key Generator
DNS TXT record
Private key (keep secret!)
The private key is generated locally in your browser only and is never transmitted. Store it securely on your mail server – never share it.
The public key goes into DNS as a TXT record, the private key onto the mail server (e.g. OpenDKIM, Rspamd). 2048 bit is the current standard.
What is a DKIM record?
DKIM (DomainKeys Identified Mail) cryptographically signs outgoing email. The receiving server verifies the signature using a public key you publish as a DNS TXT record – proving a message really came from your domain and was not altered in transit.
This generator creates the RSA key pair entirely locally in your browser (Web Crypto). The private key never leaves your device. Enter selector and domain, click "Generate key pair" and copy the TXT record into your DNS zone.
Setting up DKIM correctly
- Choose a selector (e.g.
defaultormail) – it appears in the DNS nameselector._domainkey.your-domain - Publish the public key as a TXT record in DNS
- Store the private key on your mail server (OpenDKIM, Rspamd, Mailcow, etc.)
- Together with SPF and DMARC, DKIM is the basis for deliverable email