How to Use the DKIM Record Generator
Generate a DKIM record by choosing a selector and key size, then publish the public key in DNS and keep the private key file safe.
- Enter a selector, such as s2026, and the domain that signs the mail.
- Keep the 2048-bit key size unless your DNS host cannot store a long TXT value.
- Select Generate key pair, then download the private key file straight away.
- Publish the TXT value at the host name shown and install the private key in your mail server or sending service.
- Check the published key with the DKIM Checker before you switch signing on.
Generate a DKIM Key Pair
A DKIM key pair is a private key that signs outgoing mail and a public key that receivers fetch from DNS to verify the signature. This tool generates both in your browser and builds the TXT record for the public half.
DKIM Record Structure
The record lives at selector._domainkey.yourdomain and reads v=DKIM1; k=rsa; p= followed by the base64 public key. The selector is any label you choose, and the signing server writes it into the s= tag of every DKIM-Signature header. Several selectors can exist side by side, which is what makes key rotation possible.
DKIM Key Length
RFC 8301 requires RSA keys of at least 1024 bits for DKIM and recommends 2048 bits. A 2048-bit public key makes a TXT value of about 410 characters, so it is published as two quoted strings. The generator imports the finished key with the same validator as the DKIM Checker to confirm its length.
DKIM Private Key
The private key is generated with WebCrypto inside this page and exported as a PKCS#8 PEM file. It is never displayed, copied or uploaded, so download it before you leave and store it only in your mail server or sending service. Some servers want the older PKCS#1 format, which the command openssl pkey -in file.pem -traditional produces.
DKIM Key Rotation Best Practices
Rotate keys at least once a year, and at once if a private key may have leaked. Publish the new key under a new selector, switch signing to it, and remove the old record a few days later so mail still in transit verifies. Dated selectors such as s2026 make it clear which key is current.
DKIM 1024 vs 2048
A 2048-bit key is far harder to break than a 1024-bit key and is the size current guidance recommends.
| Key size | TXT value length | Recommendation |
|---|---|---|
| 1024 bits | About 230 characters, one string | Minimum allowed; use only if your DNS host limits TXT length |
| 2048 bits | About 410 characters, two strings | Recommended default |
| 4096 bits | About 750 characters, three strings | Stronger, but some DNS panels and receivers cannot handle it |
Frequently Asked Questions
What Is a DKIM Key?
It is one half of the key pair used for DKIM signing. The private key stays on the sending server and signs each message, while the public key is published in DNS so receivers can check that the message is unchanged and really comes from your domain.
How Do I Generate a DKIM Key?
Use this page to create a 2048-bit RSA pair in your browser, or run openssl genpkey on a server you control. Hosted mail services such as Google Workspace and Microsoft 365 generate the key for you, and then you only publish the record they show.
How Often Should You Rotate DKIM Keys?
Once or twice a year is common practice, and immediately after any suspected leak. Use a new selector each time so the old and new keys can overlap during the switch.
Where Do You Get a DKIM Record?
Hosted email providers show the record to publish in their admin console. When you run your own mail server, a generator like this one creates the key pair and the record, which goes in DNS as a TXT record at the selector’s _domainkey host.
Related Email Tools
Continue with the guide What Is DMARC. Policies, alignment and reports explained.