Back to Tools
📧 Free Tool

DKIM Key Generator

Build a full DKIM TXT: selector, RSA or Ed25519, hash and service tags, testing flags. Or wrap a public key you already have.

This is the case this generator is for. You mint the key, publish the TXT, and point your signer at the private key.

Host will be s1._domainkey. Suggested for Self-hosted / custom MTA: s1.

Key

Record tags

Optional DKIM DNS tags. Inbox providers honour these when present.

Hash algorithms (h=)
Service type (s=)

A DKIM generator that knows when not to generate

Most “DKIM generators” dump a 2048-bit RSA TXT and call it done. That is fine for a Postfix box. It is the wrong move for Google Workspace, Microsoft 365, Klaviyo, and SendGrid, because those platforms already hold the private key and tell you to publish a CNAME or their TXT. This tool asks who signs first.

When you do need a key, the DNS record is more than p=. h=sha256 pins the hash. s=email limits the service. t=y is testing. t=s stops subdomain use. n= is a note. Ed25519 is here for MTAs that speak RFC 8463. sha1 is here with a warning because some ancient signer still asks for it.

After you publish, look the selector up with the DKIM checker. A valid public key still does not mean mail is signed. That only shows up in the headers.

DKIM Record Checker

Look up published selectors, key size, and revoked empty keys.

Check DKIM →

SPF Record Checker

DKIM is the signature. SPF is still the allow-list. Check both.

Check SPF →

DKIM Generator FAQ

How do I generate a DKIM key?

Pick a selector, key type, and record options, then generate. Publish only the TXT public key at selector._domainkey and install the private key on the signer. If Google, Microsoft, Klaviyo, or SendGrid send for you, use their wizard instead. They already hold the private key.

What selector should I use?

Anything unique on the domain: s1, google, selector1, or a date like 20260903. It must match the s= tag in the DKIM-Signature header. Do not overwrite a selector you are already signing with until the mail server has switched.

RSA or Ed25519?

RSA 2048-bit is the safe default and what most ESPs and inbox providers expect. Ed25519 (RFC 8463) makes a short TXT and a strong key, but plenty of signers and some receivers still do not support it. Use Ed25519 only if you know the MTA will sign with it.

What do h=, s=, t=, and n= mean?

h= lists hash algorithms the key may use (sha256, optionally sha1). s=email limits the key to email. t=y is testing mode. t=s means the key is not valid for subdomains. n= is a human note in the record. All of those except p= are optional.

Can I paste an existing public key?

Yes. Turn off key generation and paste a PEM or the raw p= Base64. The tool will wrap it in a DKIM TXT with the tags you chose. It will not invent a private key for a public key you already have.

Where does the private key go?

On the mail server or ESP that will sign outgoing mail. Never in DNS. Never in a public ticket. If it leaks, generate a new pair on a new selector and revoke the old one with an empty p=.

Why is the TXT longer than 255 characters?

A 2048-bit RSA public key does not fit in one DNS character-string. It is still one TXT record, split into quoted chunks. Cloudflare usually wraps a single paste. Bind-style zones need the split or the zone snippet.

Does generating a key publish it or start signing?

No. This creates a record in memory. You still paste the TXT, configure the signer, and check a real message for dkim=pass.

Want the rest of the setup checked?

A key pair is one piece. A free audit covers authentication, list quality, and the sending habits that actually move inbox placement.

Get Your Free Audit →