DKIM Generator

DKIM (DomainKeys Identified Mail) signs every message your server sends. The server signs with a private key; receivers check the signature with the matching public key, which you publish in DNS. A valid signature proves the message really comes from your domain and was not changed on the way, and it is what DMARC needs to pass when mail is forwarded.

This DKIM generator creates both halves. The private key goes into your mail server or sending service. The public key goes into a TXT record at a name made of a selector you choose and your domain:

mail2026._domainkey.example.com  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh…"

The selector (mail2026 here) is any name. It lets one domain have several keys at once, for example one per sending service, or an old and a new key while you switch.

• RSA 2048 is the default. The DKIM rules say signers should use RSA keys of at least 2048 bits (RFC 8301), and receivers must accept keys up to 4096 bits, so 3072 and 4096 are offered too.
• Ed25519 (RFC 8463) gives a much shorter record, but many receivers do not check it yet (in an April 2026 test, Gmail, Microsoft 365 and Yahoo did not), so use it only next to an RSA key under another selector.

Your private key stays on your device. The keys are created by your browser's built-in cryptography (WebCrypto). This page makes no request with the key, does not store it and cannot show it to you again: copy or download it before you leave.

The DKIM record generator then checks the record the way a receiver reads it: v=DKIM1 first, the right key format for p=, a valid selector, and a name that fits in DNS.

The panel above the record is the verdict of the new key record: a colored icon and a short label. Pass: the key and record are ready. Warning: the key and record are valid, but read the note: in test mode receivers treat your mail as unsigned, and an Ed25519 key needs an RSA key next to it. Fail: no key was created; the result says why.

A new key was created

The result names the key type and length and shows three things: the DNS record to publish, the private key (PKCS#8 PEM, the -----BEGIN PRIVATE KEY----- form most mail software reads) and, under a fold, the public key in PEM form for tools that ask for it. The copy button labeled for Amazon SES gives the private key as one line without the BEGIN and END lines, which is how Amazon SES asks for it.

Key type and length

• RSA keys shorter than 2048 bits or longer than 4096 bits are refused: signers should use at least 2048, and receivers are only required to handle up to 4096.
• With Ed25519 the result warns you to also sign with an RSA key under a different selector. Never use Ed25519 as your only DKIM key: in a test published in April 2026, Gmail, Microsoft 365 and Yahoo did not check Ed25519 signatures, so mail signed with Ed25519 alone would get no DKIM pass from them. RFC 8463 §6 describes this setup: two signatures, one per algorithm, under different selectors. The Ed25519 p= value is the bare 44-character key, as RFC 8463 requires.
• A key type other than RSA or Ed25519 is refused.

The selector

A selector may contain letters, digits and hyphens, in one or more parts separated by dots, such as mail2026 or s1.news. Enter only the selector, not ._domainkey. A selector and domain that together are longer than a DNS name can be (253 characters) are refused.

The domain name

Enter the domain that signs the mail, the d= value in the DKIM-Signature header, such as example.com. For DMARC it should be the domain in your From address or another name under the same registered domain (for example mail.example.com for mail from example.com); if your DMARC record asks for strict alignment (adkim=s), it must be exactly the From domain.

DKIM test mode (t=y)

With test mode the record carries t=y, and receivers must treat your mail as if it were not signed (RFC 6376 §3.6.1). This is the DKIM key's own test flag, not the t=y test mode of a DMARC record from the DMARC generator: the letters are the same, the meaning is not. It is useful only while you check that signing works; the result warns you to remove it afterwards.

When your browser cannot create the key

• Key creation needs WebCrypto, which browsers offer only on secure (https) pages. If it is missing, open this page over https in an up-to-date browser.
• Ed25519 needs a recent browser: Chrome 137, Firefox 129 or Safari 17 and later. In older browsers choose RSA.
• Rarely, a browser creates the key but refuses to export it. Try again or use another browser; no key has been shown or saved.

Why the record is split into strings

One string in a TXT record holds at most 255 characters, and a 2048-bit RSA record is about 410. The record is therefore stored as several strings inside one TXT record; receivers join them without spaces (RFC 6376 §3.6.2.2). If your DNS provider takes one value, paste the whole value; if it wants quoted strings, use the zone file line. A record too large for any DNS answer is refused.

Many email services create their own DKIM keys and only need you to publish the records they give you. Use this generator where you bring your own key: your own mail server, or a service that lets you import one.

1. Install the private key in the server or service that signs your mail, with the selector and domain.
2. Publish the record as a TXT record at the host selector._domainkey (for example mail2026._domainkey) at your DNS provider. There must be only one TXT record per selector.
3. Turn on signing and send yourself a test message; look for dkim=pass in its headers.

Google Workspace

Google creates the key for you. In the Google Admin console go to Apps > Google Workspace > Gmail > Authenticate email, select Generate New Record (2048 bits if your DNS provider supports it; the default selector is google), publish the TXT record it shows, then select Start authentication. Google says it can take up to 48 hours to start working.

Microsoft 365

Microsoft 365 generates two key pairs for your domain and keeps the private keys itself; you cannot use a key from here. You publish two CNAME records, selector1._domainkey and selector2._domainkey, with the values shown in the Microsoft Defender portal under Email & collaboration > Policies & rules > Threat policies > Email authentication settings, on the DKIM tab.

Zoho Mail

Zoho creates the key too. In the Zoho Mail Admin Console open Domains, choose the domain, then the Email Configuration tab and DKIM. Enter a selector, choose 1024 or 2048 bits, publish the TXT record Zoho shows at selector._domainkey and select Verify.

SendGrid

SendGrid handles DKIM through domain authentication: with automated security you publish CNAME records it gives you (such as s1._domainkey and s2._domainkey) and SendGrid manages the keys.

Mailgun

Mailgun's Automatic Sender Security publishes two 2048-bit keys through the CNAME records pdk1._domainkey and pdk2._domainkey and rotates them every 120 days by default. As an advanced option Mailgun can import an existing key from a PEM file. Its own keys are 1024 or 2048 bits, so if you import a key from this page, choose RSA 2048.

Amazon SES

With Easy DKIM, SES creates the keys and gives you three CNAME records. With Bring Your Own DKIM you use your own key: SES accepts RSA keys from 1024 to 2048 bits, so choose RSA 2048 here. Publish the record at selector._domainkey.example.com, then in the SES console open the domain's DKIM settings, choose Provide DKIM authentication token (BYODKIM) and paste the private key as one line (the Amazon SES copy button). AWS says DNS changes can take up to 72 hours to be detected.

Cloudflare

On the DNS Records page select Add record, type TXT, Name mail2026._domainkey (your selector), paste the value into Content and select Save.

GoDaddy

In the domain's DNS settings select Add New Record, type TXT, Name mail2026._domainkey, paste the value into Value and select Save.

Namecheap

On the Advanced DNS tab select Add New Record, choose TXT Record, Host mail2026._domainkey (without your domain), paste the value into Value and select Save all changes.