DKIM 密钥生成器
Generate a DKIM key pair locally in your browser to sign outgoing mail and protect messages from tampering, or paste an existing DNS record to verify its configuration.
什么是 DKIM？
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to your outgoing emails using a private key stored on your mail server. Receiving mailbox providers look up the matching public key in your domain's DNS to confirm the message came from your domain and arrived unaltered.
You generate the key pair once per selector. The private key stays with your mail server or email provider to sign outbound messages, while the public key is published as a DNS TXT record under that selector so receiving servers can verify the signature.
选择器
A short prefix that lets you publish multiple DKIM keys under one domain so you can rotate keys safely or separate different sending services.
公钥（DNS）
Published as a TXT record at selector._domainkey.yourdomain.com so receiving mail servers can fetch it and validate message signatures.
私钥（您的服务器）
Installed on your mail server or sending platform to sign outgoing messages. Keep it confidential and store it in your secrets manager.
DKIM proves a message was signed by your domain and arrived intact, while DMARC tells receivers how to handle messages that fail authentication. Once your DKIM signature passes, use the DMARC policy generator to configure enforcement.
生成您的密钥
Enter your domain and selector, choose a key length, and generate your key pair. You can also paste an existing TXT record on the right to inspect its fields.
生成密钥对
完全在您的浏览器中运行。私钥不会被发送到任何地方。
密钥长度
当前推荐使用 2048 位。1024 位安全性较低但更短，如果您的 DNS 提供商处理长 TXT 记录有困难，这一点很重要。
限制哈希算法为 SHA-256
h仅允许 SHA-256 签名。关闭此选项将同时接受较旧且较弱的 SHA-1。大多数发件人应保持开启。
限制为电子邮件
s将此密钥限制为仅用于签署电子邮件，使其无法被重用于签署其他碰巧检查 s 标签的内容。
测试模式
t=y要求接收方暂时不对签名验证失败采取行动。在部署阶段很有用。待邮件签名和验证正常通过后再关闭此选项。
严格子域名匹配
t=s要求签名域与您的发件人域完全匹配，使此密钥无法用于为子域名签名。
私钥
生成密钥对以在此处查看您的私钥。
DNS 记录
在您的域名下发布此 TXT 记录。
在您的 DNS 提供商处添加一条新记录。"Type" 和 "Host" 是它要求填写的字段。某些提供商只需要在主机字段中填写 mail._domainkey，会自动为您补充域名。
在此粘贴现有记录进行检查。此操作不会恢复私钥。
生成、发布并验证
Generate a key pair for your mail server and install the private key where that server signs outgoing messages.
Publish the public key as a TXT record at the generated selector hostname with your DNS provider.
Send a test email and verify that DKIM passes using the Email header analyzer.
对于通过 Bird 发送的邮件，请使用 Bird 为您生成的签名密钥。从您的域名复制完整的 DNS 记录，按照DNS 发布指南操作，然后检查域名验证状态。