DKIM Key Generator

DKIM signs every outgoing message with a private key; receivers check the signature with the public key you publish in DNS. This generator creates a fresh RSA key pair inside your browser with WebCrypto and gives you the DNS record name, the TXT value (also split into 255-character strings for DNS hosts that need it) and the private key as a PEM file for your mail server. A test signature confirms the pair works. Nothing is uploaded.

How to use this tool

1. Enter your sending domain and a selector name (for example a date such as 2026a).
2. Keep 2048-bit unless your DNS host cannot store long records.
3. Publish the TXT value at selector._domainkey.yourdomain.
4. Install the private key in your mail server's DKIM signer and send a test message to check the signature passes.

Formula

DNS name: <selector>._domainkey.<domain> · TXT: v=DKIM1; k=rsa; p=<base64 SubjectPublicKeyInfo>

The key is RSASSA-PKCS1-v1_5 with public exponent 65537, used with SHA-256 (rsa-sha256, RFC 6376; RFC 8301 forbids rsa-sha1 for signing). A single DNS string holds at most 255 characters, so 2048-bit keys are published as two quoted strings in one TXT record.

Example

For example.com with selector s1, publish a TXT record at s1._domainkey.example.com whose value starts with v=DKIM1; k=rsa; p=MIIB… For a 2048-bit key the value is about 410 characters, published as two quoted strings. The private key file s1.example.com.private.pem goes to your mail server; the "Key pair check" shows OK when the keys sign and verify correctly.