Generator kluczy DKIM
Generate a DKIM key pair, get the DNS record and private key it produces, or paste a record you already have and check it. The key pair is generated locally in your browser and never sent anywhere.
Czym jest DKIM?
DKIM (DomainKeys Identified Mail) attaches a digital signature to every message you send, using a private key only your mail server knows. The receiving mailbox looks up the matching public key in your DNS and checks the signature, proof the message really came from you and wasn't altered in transit.
The key pair is generated once. The private key stays on your mail server or your email service provider, where it signs outgoing mail. The public key goes into a DNS TXT record at a location called the selector. That's the only part this tool publishes for you.
Selektor
A short name that lets you run more than one key at once, useful for rotating keys or running several sending services side by side.
Klucz publiczny (DNS)
Published as a TXT record at selector._domainkey.yourdomain.com. Anyone can look it up: that's the point.
Klucz prywatny (Twój serwer)
Przechowywany w tajemnicy i zainstalowany tam, gdzie Twoja poczta jest faktycznie podpisywana. Nigdy go nie publikuj i nigdy nie wysyłaj nigdzie indziej.
DKIM on its own only proves a message wasn't tampered with. It's DMARC that decides what happens when a message fails. Once DKIM is signing cleanly, the DMARC policy generator is the natural next step.
Wygeneruj swój klucz
Fill in your domain and selector, pick a key size, and generate. The DNS record on the right updates with it. Already have a record? Paste it in to check it.
Wygeneruj parę kluczy
Runs entirely in your browser. The private key is never sent anywhere.
Rozmiar klucza
2048-bit to aktualnie zalecany rozmiar. 1024-bit jest słabszy, ale krótszy — co ma znaczenie, jeśli Twój dostawca DNS ma problemy z długimi rekordami TXT.
Ogranicz haszowanie do SHA-256
hOnly allow SHA-256 signatures. Leaving this off also accepts the older, weaker SHA-1. Most senders should keep this on.
Ogranicz do e-maila
sOgranicz ten klucz do podpisywania e-maili, aby nie mógł być ponownie użyty do podpisywania czegokolwiek innego, co sprawdza tag s.
Tryb testowy
t=yAsk receivers not to act on a signature failure yet. Useful while you roll this out. Turn it off once mail is signing and passing cleanly.
Ścisłe dopasowanie subdomeny
t=sWymagaj, aby domena podpisująca dokładnie odpowiadała domenie nadawcy (From), dzięki czemu ten klucz nie może być używany do podpisywania w imieniu subdomeny.
Klucz prywatny
Wygeneruj parę kluczy, aby zobaczyć tutaj swój klucz prywatny.
Rekord DNS
Opublikuj ten rekord TXT w swojej domenie.
Add this as a new record at your DNS provider. “Type” and “Host” are the fields it asks for. Some providers want just mail._domainkey in the host field and add the domain for you.
Paste an existing record here to check it. It won't recover a private key.