DKIM Generator
Choose your sending platform, add the email addresses you send from, and generate a DKIM key pair and DNS record for each domain.
Generate the key pair here, publish the public record in DNS and install the private key in your mail server or signing software.
The keys are generated in your browser with the Web Crypto API and are not sent to a server. Copy the private key somewhere safe, because it cannot be recovered.
What is DKIM Generator?
DKIM adds a cryptographic signature to your email, and receivers check it against a public key published in your DNS. This generator creates the RSA key pair and the DNS TXT record in your browser. Pick your sending platform to see whether it creates the key for you, and add the email addresses you send from to see which domain's key covers each one. Keep the private key secret and never publish it in DNS. Most email services generate their own DKIM keys, so use their records when they provide them, and check the published record with the DKIM Validator.
Why use this tool?
- Choose your sending platform to see whether it creates the DKIM key for you.
- Add the email addresses you send from, and the tool groups them by domain and shows which key covers each one.
- Generate a 2048-bit or 1024-bit RSA key pair for each domain, up to five at a time.
- The keys are created in your browser and are not sent to a server.
How to use DKIM Generator
- Step 1. Enter your main sending domain and a selector, such as default or a year-based name.
- Step 2. Choose your sending platform. If it creates the key for you, use its DNS records instead of your own.
- Step 3. Add the email addresses you send from. Addresses on other domains get their own key pair.
- Step 4. Choose a key size and select Generate DKIM key pair.
- Step 5. Publish each TXT record at the host shown, and install the matching private key in your mail server or signing software.
- Step 6. Check the published record with the DKIM Validator.
Common use cases
Important notes
- DKIM keys belong to domains and selectors, not to individual mailboxes. The sender email list is used to decide which domains need a key.
- A key on your main domain covers addresses on its subdomains when DMARC alignment is relaxed, which is the default. Under strict alignment, each subdomain needs its own key.
- Many email services, including Google Workspace and Microsoft 365, create the DKIM key themselves. Use the records they give you unless they let you upload your own key.
- Keep the private key secret. It cannot be recovered after you leave the page, so copy or download it first.
- A single DNS string is limited to 255 characters. A 2048-bit record is longer, so the tool also shows it split into quoted parts.
More DNS & Website Tools
DKIM Generator FAQ
Does each email address need its own DKIM key?
No. Keys belong to a domain and selector. The addresses you add only help the tool work out which domains need a key.
Should I generate my own key or use my provider's?
Use your provider's records when it creates the key for you. Generate your own for a self-managed mail server, or when your provider supports uploading a key.
What is a DKIM selector?
A label that lets a domain publish more than one key. The record is published at selector._domainkey.yourdomain.com.
Should I use a 1024-bit or 2048-bit key?
Use 2048-bit when your DNS host allows it. A 1024-bit key fits hosts with record length limits, but it is weaker.
Is my private key sent anywhere?
No. The key pair is created in your browser with the Web Crypto API. Download or copy the private key before you close the page.