Free Online Tool

DKIM Key Generator

Generate an RSA key pair for DKIM in your browser. Get your DNS TXT record and private key instantly — keys never leave your device.

Keys are generated entirely in your browser using the Web Crypto API. No key material is ever sent to our servers.

1 Domain & Selector

Your root sending domain — used to build the DNS record name.

A label you choose to identify this key — e.g. mail, s1, google. Alphanumeric and hyphens only. The DNS record will be published at mail._domainkey.yourdomain.com.

2 Key Settings

RSA 2048-bit is the current best practice. 1024-bit is considered weak.

Use testing mode during initial setup to verify everything works before full enforcement.

FAQ

Frequently asked questions

Yes. We use the browser's built-in Web Crypto API (window.crypto.subtle) to generate the RSA key pair entirely on your device. No key material is ever transmitted to our servers or any third party. The generation happens locally in JavaScript.
The private key goes on your mail server or in your email provider's DKIM configuration. It is used to cryptographically sign every outgoing email. Keep it secret — anyone with the private key can sign emails as your domain. Store it securely and never put it in DNS.
Only the public key goes in DNS as a TXT record at selector._domainkey.yourdomain.com. The record looks like: v=DKIM1; k=rsa; p=MII... Receiving mail servers use this public key to verify the signature on your emails.
RSA 2048-bit is the current standard and widely recommended. 1024-bit is considered weak by modern standards and should be avoided. 4096-bit provides maximum strength but the resulting TXT record may exceed length limits on some DNS providers.
Best practice is to rotate DKIM keys every 6–12 months. Use a different selector for the new key so both can coexist during the transition. After switching mail servers to the new key, revoke the old one by setting its DNS record to p= (empty value).

Verify your DKIM record is live

After publishing, use our free DKIM Lookup to confirm the key is resolving correctly.

Check DKIM Record