DKIM 密钥生成器
Generate a DKIM key pair, get the DNS record and private key it produces, or paste a record you already have and check it. The key pair is generated locally in your browser and never sent anywhere.
什么是 DKIM？
DKIM (DomainKeys Identified Mail) attaches a digital signature to every message you send, using a private key only your mail server knows. The receiving mailbox looks up the matching public key in your DNS and checks the signature, proof the message really came from you and wasn't altered in transit.
The key pair is generated once. The private key stays on your mail server or your email service provider, where it signs outgoing mail. The public key goes into a DNS TXT record at a location called the selector. That's the only part this tool publishes for you.
选择器
A short name that lets you run more than one key at once, useful for rotating keys or running several sending services side by side.
公钥（DNS）
Published as a TXT record at selector._domainkey.yourdomain.com. Anyone can look it up: that's the point.
私钥（您的服务器）
妥善保密，安装在实际进行邮件签名的地方。切勿公开发布，也切勿发送到其他任何地方。
DKIM on its own only proves a message wasn't tampered with. It's DMARC that decides what happens when a message fails. Once DKIM is signing cleanly, the DMARC policy generator is the natural next step.
生成您的密钥
Fill in your domain and selector, pick a key size, and generate. The DNS record on the right updates with it. Already have a record? Paste it in to check it.
生成密钥对
Runs entirely in your browser. The private key is never sent anywhere.
密钥长度
当前推荐使用 2048 位。1024 位安全性较低但更短，如果您的 DNS 提供商处理长 TXT 记录有困难，这一点很重要。
限制哈希算法为 SHA-256
hOnly allow SHA-256 signatures. Leaving this off also accepts the older, weaker SHA-1. Most senders should keep this on.
限制为电子邮件
s将此密钥限制为仅用于签署电子邮件，使其无法被重用于签署其他碰巧检查 s 标签的内容。
测试模式
t=yAsk receivers not to act on a signature failure yet. Useful while you roll this out. Turn it off once mail is signing and passing cleanly.
严格子域名匹配
t=s要求签名域与您的发件人域完全匹配，使此密钥无法用于为子域名签名。
私钥
生成密钥对以在此处查看您的私钥。
DNS 记录
在您的域名下发布此 TXT 记录。
Add this as a new record at your DNS provider. “Type” and “Host” are the fields it asks for. Some providers want just mail._domainkey in the host field and add the domain for you.
Paste an existing record here to check it. It won't recover a private key.