Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
Free tool

DKIM Key Generator

Create a DKIM key pair for a mail server you run, with the exact DNS TXT record to publish. Keys are generated in your browser, so we never see your private key.

Using Microsoft 365 or Google Workspace? Don't use this tool for them. Both create their own DKIM keys: you turn DKIM on in their admin consoles and publish the records they give you. Our DKIM setup guide for Microsoft 365 and Google Workspace walks through it. On cPanel, use its Email Deliverability page instead.

Generate a DKIM key pair

For mail servers you run yourself (OpenDKIM, Exim, Postfix with a milter and similar). The key is generated in your browser — nothing is uploaded, and we never see the private key.

The domain in your From addresses (the DKIM d= value).

Letters, digits and hyphens. A date-based name such as s202610 makes rotation easy; never reuse an old selector.

Key type

What the DKIM Key Generator does

DKIM (RFC 6376) lets your mail server sign each message with a private key. Receivers look up the matching public key in DNS and check the signature. This tool creates both halves for a server you run yourself:

  • The private key in PEM format (PKCS#8), to copy or download as a .pem file and install on the signing server.
  • The DNS record: a TXT record named <selector>._domainkey.<your domain> with the value v=DKIM1; k=rsa; p=….
  • The value split into strings of up to 255 characters, for DNS hosts that need it, plus a zone-file line.
  • Setup examples for OpenDKIM, Postfix and Exim that use your domain and selector, and a link to check the published record with the DKIM Checker.

Before showing the record, the page reads the public key back out of the TXT value, imports it, and verifies a test signature made with the private key, so you know the two halves match.

The key is generated in your browser. Nothing is uploaded. The page uses the Web Crypto API built into your browser. We never see your private key, and the page doesn't store it.

Don't use it for hosted mail platforms

Platform What to do instead
Microsoft 365 Microsoft generates two key pairs when you enable DKIM for a custom domain. The private keys are inaccessible; you publish two CNAME records, selector1._domainkey and selector2._domainkey, and turn signing on in the Defender portal or Exchange Online PowerShell.
Google Workspace A super administrator generates the key in the Admin console, choosing 2048 or 1024 bits. The default selector is google.
cPanel / WHM The Email Deliverability page can generate a local DKIM key and shows the suggested record, which you can give to an outside DNS provider.
Marketing, CRM and helpdesk tools Use the tool's own "custom domain" or "authenticate your domain" setup. It gives you the records to publish.

Our DKIM setup guide for Microsoft 365 and Google Workspace walks through both platforms.

Choosing a key type

Option When to use it Source
RSA 2048-bit The default. Every receiver can verify it. RFC 8301: signers "SHOULD use RSA keys of at least 2048 bits"
RSA 1024-bit Only if your DNS host can't store a long TXT record. Upgrade when you can. RFC 8301: signers "MUST use RSA keys of at least 1024 bits"; verifiers must reject anything shorter
Ed25519 Advanced: as a second signature next to RSA. Shown only if your browser supports it. RFC 8463

RFC 8463 adds the Ed25519-SHA256 algorithm. Its records use k=ed25519, and the public key in p= is only 44 characters, so it fits in one string. The RFC says verifiers MUST implement it, but it is newer than RSA and the large mailbox providers don't document whether they verify it. RFC 8463 notes that signers can add signatures with old and new algorithms side by side, each under its own selector. Do that, and confirm the results in a test message's Authentication-Results header with the Email Header Analyzer.

Publishing the record

  1. In your DNS host, create a TXT record. The name is <selector>._domainkey.<domain>; most DNS hosts want only <selector>._domainkey in the host field and add the domain themselves.
  2. Paste the value. If the host rejects it as too long, use the split version: several quoted strings in one record. RFC 1035 limits each string to 255 characters, and RFC 6376 says the strings "MUST be concatenated together before use with no intervening whitespace".
  3. Wait for the record to appear, then check it with the DKIM Checker.
  4. Only then install the private key and turn on signing.

The record starts with v=DKIM1, which RFC 6376 says must be the first tag. An empty p= means the key has been revoked, which is how you retire an old selector.

Installing the private key

The setup examples on this page use your domain and selector. In short:

  • OpenDKIM: a KeyTable maps a key name to the domain, selector and key file, and a SigningTable picks the key by From address. With the default RequireSafeKeys, OpenDKIM refuses a key file other users can read or write, so make it readable by the opendkim user only.
  • Postfix: add the OpenDKIM socket to smtpd_milters and non_smtpd_milters (Postfix milter documentation). milter_default_action decides what happens if the milter is unavailable; the default is tempfail.
  • Exim: set dkim_domain, dkim_selector and dkim_private_key on the smtp transport (Exim specification). Exim supports Ed25519 keys with GnuTLS 3.6.0 or OpenSSL 1.1.1 or later.

Keep the private key secret

RFC 6376 section 8.3 is blunt: anyone with the private key can send mail signed as your domain. Keep it only on the signing server, readable only by the signing service. Don't email it, paste it into tickets or chat, or commit it to a code repository. If you think it has been exposed, publish a new key under a new selector, switch signing to it, and revoke the old one.

Plan rotation from the start. M3AAWG recommends rotating DKIM keys at least every six months under a new selector each time; our guide on DKIM key rotation has the full procedure.

Without JavaScript

The tool needs JavaScript because the key is made on your device. Without it, you can generate the same kind of key with OpenSSL, as in RFC 6376 Appendix C, using 2048 bits:

openssl genrsa -out s202610.pem 2048
openssl rsa -in s202610.pem -pubout -outform PEM

Put the base64 lines of the public key, without the BEGIN and END lines, after v=DKIM1; k=rsa; p= in the TXT record.

Sources

Frequently asked questions

Is the private key sent to your servers?

No. The key pair is generated by your browser's built-in Web Crypto API on your device. The page makes no network request with it and doesn't store it. If you close the page without saving the key, it's gone and you generate a new pair.

Should I use this for Microsoft 365 or Google Workspace?

No. Microsoft 365 generates its DKIM keys itself, keeps the private keys, and has you publish two CNAME records. Google Workspace generates the key in the Admin console. Turn DKIM on there instead; our DKIM setup guide for both platforms has the steps.

Which key type should I choose?

RSA 2048-bit. RFC 8301 says signers SHOULD use RSA keys of at least 2048 bits and MUST NOT go below 1024. Choose 1024 only if your DNS host can't store a long TXT record, and add Ed25519 only as a second signature beside RSA.

Why is my DKIM record split into several strings?

A single string inside a DNS TXT record can hold at most 255 characters, and a 2048-bit RSA record is about 400. The record is stored as several strings that receivers join back together with nothing between them. Many DNS hosts do the split for you.

What selector name should I use?

Any short name of letters, digits and hyphens. A date-based name such as s202610 makes rotation simple, because every new key gets a new selector. Don't reuse an old selector for a new key, and keep the old key published until mail signed with it has been delivered.

Related guides

SPF, DKIM & DMARC

DKIM 2048-bit key too long for a TXT record: how to split it correctly

Why a 2048-bit DKIM key won't fit in one 255-character TXT string, how to split it correctly, what Cloudflare, Route 53 and GoDaddy expect, and how to check it.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

How to set up DKIM in Microsoft 365 and Google Workspace

Step-by-step DKIM setup for Microsoft 365 (two CNAME selectors) and Google Workspace (one TXT key): 2048-bit keys, key rotation and how to verify it works.

9 min read