Easily create a valid DKIM record for your domain with our free DKIM generator. Strengthen email authentication and secure your messages from spoofing
A DKIM generator creates the RSA key pair a mail server uses to sign outgoing email, plus the DNS TXT record that publishes the public key. Enter your domain and a selector, choose a key length, and the tool generates everything with your browser's Web Crypto API. The private key is created on your device and never sent to PagesTest.
Usually not. Hosted email and sending services (Google Workspace, Microsoft 365, Mailchimp, SendGrid, Amazon SES and others) generate DKIM keys for you and show the record to publish. Use this generator when you run the signing server, for example Postfix with OpenDKIM or rspamd, or an application that signs mail itself.
mail or a date like 202610. Using a new selector for each key makes rotation easy.selector._domainkey.example.com). Many DNS panels want only selector._domainkey as the host name.dkim=pass in its headers.v=DKIM1; k=rsa; p=…, where p is the public key in Base64. This goes in DNS.d=) must match the From address domain for DMARC alignment. Check the policy with the DMARC Lookup.The key is generated by your browser's Web Crypto API and stays on your device. Clear the output after copying it, and generate keys on a device you trust. If you prefer, the equivalent with OpenSSL is openssl genrsa -out dkim.key 2048.
2048 bits. 1024-bit keys are the minimum receivers accept and are no longer recommended. 4096-bit keys work but some DNS providers and receivers handle them poorly.
A common practice is every 6 to 12 months, and immediately if the private key may have leaked. Publish the new selector, switch signing to it, and remove the old record after a few days.