DKIM Key and Record Generator
Create a DKIM signing key pair with your browser's own cryptography. You get a private key for your mail server and a ready-to-publish TXT record for the selector.
The key pair is created with the Web Crypto API inside this tab. Nothing is transmitted, and closing the page destroys the key permanently.
How to use
- Enter your domain and choose a selector. Any short label works; many teams use a date or a service name.
- Pick 2048 bit unless your DNS host cannot handle the record length.
- Click Generate. Copy the private key straight into your mail server or signing service.
- Publish the TXT record on selector._domainkey.yourdomain, then send a test message and check the signature verifies.
Frequently asked questions
- Is it safe to generate a private key in a browser?
- The key is produced by the Web Crypto API in your own tab and is never sent anywhere. Still, generate it on a machine you trust, and rotate the selector if you ever suspect exposure.
- My DNS host rejects the record as too long.
- A 2048 bit public key exceeds 255 characters, so the value must be split into several quoted strings. Many control panels do this automatically; if yours does not, use a 1024 bit key or a host that supports splitting.
- How often should I rotate DKIM keys?
- Once or twice a year is a reasonable rhythm. Publish a new selector, switch signing to it, then remove the old record after a week.