Generate a fresh RSA key pair for DKIM email signing, entirely in your browser. You get the TXT record to publish at selector._domainkey, a zone-file version split into 255-character strings, and the private key as a PEM file for your mail server.
Last updated:
1. DNS TXT record
Type
TXT
Host / Name
Value
TTL
3600(or your host's default)
Zone file format (split into 255-character strings)
2. Private key (keep secret)
Install it on your mail server or signing service. Anyone with this key can sign mail as your domain.
3. Public key
OpenDKIM config lines
Advertisement
Advertisement
How to use the DKIM Record Generator
Enter your domain and a selector (or keep the date-based default).
Pick the key size: 2048-bit unless your DNS host cannot store long TXT records.
Click Generate DKIM keys and download the private key right away.
Publish the TXT record at your DNS host with the shown host name and value.
Configure your mail server to sign with the private key and selector, then send a test email and verify it with the DKIM Record Checker.
Setting up DKIM step by step
Generate the key pair above and save the private key file somewhere only the mail server can read (for example permissions 600, owned by the opendkim user).
Publish the public key as a TXT record at selector._domainkey.yourdomain. Wait for the TTL and confirm it with the DKIM Record Checker.
Configure signing on your server with the same domain and selector (OpenDKIM KeyTable and SigningTable lines are shown above).
Send a test message to a mailbox you control and open its headers: look for dkim=pass in the Authentication-Results header.
The selector is only a label. Something like s202610 (year and month) tells you at a glance how old a key is and lets you publish the next key under a new name without touching the current one.
Frequently asked questions
What does a DKIM record generator create?
Two things: a private key that your mail server uses to sign outgoing messages, and a DNS TXT record containing the matching public key. Receivers look up the TXT record at selector._domainkey.yourdomain to verify the signatures. Both halves must come from the same key pair.
Are the keys generated securely?
Yes. The key pair is created by your browser's built-in Web Crypto API, which uses the operating system's cryptographically secure random number generator. The keys never leave the page, are not stored anywhere and disappear when you close the tab, so download the private key before leaving.
Should I use a 1024-bit or 2048-bit key?
Use 2048 bits. RFC 8301 recommends at least 2048-bit RSA keys for signers, and large mailbox providers advise the same. Choose 1024 bits only if your DNS provider cannot publish TXT records longer than 255 characters, and plan to move to 2048 later.
What host name do I enter at my DNS provider?
Enter selector._domainkey as the host or name, for example s202610._domainkey. Many dashboards add your domain automatically; if yours asks for the full name, use s202610._domainkey.example.com. The record type is TXT and the value is the v=DKIM1 string.
Why is the record split into several strings?
A single character string in a DNS TXT record is limited to 255 characters, and a 2048-bit DKIM value is about 410 characters. In zone files it is written as several quoted strings in parentheses, which verifiers join back together. Most web dashboards accept the full value and split it for you.
Do I need this if I use Google Workspace or Microsoft 365?
Usually not. Hosted email services generate their own DKIM keys: Google Workspace gives you a TXT value in the Admin console, and Microsoft 365 asks you to publish two CNAME records. This generator is for self-hosted mail servers (Postfix with OpenDKIM, Exim, Haraka and others) and services that let you bring your own key.
How often should I rotate DKIM keys?
A common practice is every 6 to 12 months. Publish a new selector with a new key, switch your server to sign with it, wait a few days, then replace the old record's p= value with an empty one to revoke it. Date-based selectors make this easy to track.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.