Generate a 2048-bit DKIM keypair. Everything runs in your browser, so the private key never touches our servers. Publish the DNS record, then add the private key to your mail server or ESP.
1. Publish this DNS TXT record
Host / name
Type
TXT
Value
2. Add this private key to your mail server
Keep this secret. Anyone with it can sign mail as your domain. It is shown only here and is never sent to us.
How to use your DKIM key
Publish the TXT record at the selector host shown above, on your domain's DNS.
Give the private key to your mail server or sending platform so it can sign outgoing mail.
Send yourself a message, then confirm the signature with the DKIM checker.
Many providers (Google Workspace, Microsoft 365, most ESPs) generate DKIM for you in their own console. Use this generator when you sign mail yourself or your provider does not offer it.
About this tool. DKIM adds a tamper-proof signature to the mail you send, so receivers can confirm it really came from you and was not altered. This generator creates a public and private key pair right in your browser; the private key never leaves your device. Publish the public half in DNS and load the private half into your mail platform.
Common questions.What is DKIM?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the mail you send. Receivers verify it against a public key you publish in DNS, proving the message really came from you and was not altered.
Is this DKIM generator safe?
Yes. The key pair is generated in your browser using the Web Crypto API. The private key never leaves your device or reaches our servers.
What key length should I use?
2048-bit RSA is the current standard and widely supported. 1024-bit is weaker and being phased out.
Where do the two keys go?
The public key goes in DNS as a TXT record at selector._domainkey.yourdomain.com. The private key goes into your mail platform's DKIM settings.