DKIM key generator
Generate a DKIM key pair locally in your browser to sign outgoing mail and protect messages from tampering, or paste an existing DNS record to verify its configuration.
What is DKIM?
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to your outgoing emails using a private key stored on your mail server. Receiving mailbox providers look up the matching public key in your domain's DNS to confirm the message came from your domain and arrived unaltered.
You generate the key pair once per selector. The private key stays with your mail server or email provider to sign outbound messages, while the public key is published as a DNS TXT record under that selector so receiving servers can verify the signature.
Selector
A short prefix that lets you publish multiple DKIM keys under one domain so you can rotate keys safely or separate different sending services.
Public key (DNS)
Published as a TXT record at selector._domainkey.yourdomain.com so receiving mail servers can fetch it and validate message signatures.
Private key (your server)
Installed on your mail server or sending platform to sign outgoing messages. Keep it confidential and store it in your secrets manager.
DKIM proves a message was signed by your domain and arrived intact, while DMARC tells receivers how to handle messages that fail authentication. Once your DKIM signature passes, use the DMARC policy generator to configure enforcement.
Generate your key
Enter your domain and selector, choose a key length, and generate your key pair. You can also paste an existing TXT record on the right to inspect its fields.
Generate a key pair
Runs entirely in your browser. The private key is never sent anywhere.
Key size
2048-bit is the current recommendation. 1024-bit is weaker but shorter, which matters if your DNS provider struggles with long TXT records.
Restrict hashes to SHA-256
hOnly allow SHA-256 signatures. Leaving this off also accepts the older, weaker SHA-1. Most senders should keep this on.
Restrict to email
sLimit this key to signing email, so it can't be reused to sign anything else that happens to check the s tag.
Testing mode
t=yAsk receivers not to act on a signature failure yet. Useful while you roll this out. Turn it off once mail is signing and passing cleanly.
Strict subdomain match
t=sRequire the signing domain to match your From domain exactly, so this key can't be used to sign for a subdomain.
Private key
Generate a key pair to see your private key here.
DNS record
Publish this TXT record at your domain.
Add this as a new record at your DNS provider. “Type” and “Host” are the fields it asks for. Some providers want just mail._domainkey in the host field and add the domain for you.
Paste an existing record here to check it. It won't recover a private key.
Generate, publish, and verify
Generate a key pair for your mail server and install the private key where that server signs outgoing messages.
Publish the public key as a TXT record at the generated selector hostname with your DNS provider.
Send a test email and verify that DKIM passes using the Email header analyzer.
For email sent through Bird, use the signing key Bird generates for you. Copy the exact DNS records from your domain, follow the DNS publishing guide, then check the domain verification status.
Put it into practice.
Continue with the documentation, guides and examples for this topic.