What Is a DKIM Record?
DKIM, short for DomainKeys Identified Mail, lets your mail server add a digital signature to every email it sends. The signature is made with a private key that stays on your server. Receivers like Gmail and Outlook then look up the matching public key in your DNS, in a TXT record at selector._domainkey.yourdomain.com, and check that the email really came from you and was not changed on the way.
This generator creates both keys with the Web Crypto API that is built into your browser. Many online DKIM generators make the private key on their own server, which means someone else has seen it. Here it never leaves your device.
How to Set Up DKIM With This Tool
- Enter your domain and a selector. The selector is just a label, so you can run several keys side by side, such as
s1now ands2when you rotate. - Keep 2048 bit unless your DNS panel refuses long records.
- Save the private key. Copy or download it and install it in your mail server or sending service with the same selector and domain.
- Add the TXT record in your DNS panel using the host name shown. Changes can take up to a few hours to appear.
- Send a test email to a Gmail address and check that DKIM shows as pass in the full headers.
Using Google Workspace, Microsoft 365, Mailchimp, Brevo or a similar service? They create the DKIM key for you. Use the record they give you and paste it into the checker above. This generator is for your own mail server, such as Postfix with OpenDKIM, or services that let you bring your own key, like Amazon SES. For SES, use 1024 or 2048 bit and the Copy as One Line button.
DKIM Record Tags Explained
| Tag | What it does |
|---|---|
v=DKIM1 | Version. Optional, but when used it must be the first tag. |
k=rsa | Key type. RSA is the default and works everywhere. ed25519 is newer and not checked by every receiver. |
p= | The public key in base64. Required. An empty p= revokes the key. |
t=y | Testing mode. Receivers treat your mail as if it had no signature, so remove it after testing. |
t=s | Strict mode. Mail signed for a subdomain does not match this key. |
h= and s= | Limit the hash and service. Most records leave them out. |
These rules come from RFC 6376 and the key size update in RFC 8301, which says signers must use at least 1024 bit RSA keys and should use 2048 bit.
Practical Tips
- Rotate keys once or twice a year. Publish a new selector, switch your server to it, and keep the old record for a week so mail in transit still verifies.
- Long record errors? Some DNS panels limit one string to 255 characters. Use the split version, which receivers join back together.
- Never email the private key. Anyone who has it can sign mail as your domain.
- DKIM alone is not enough. Gmail and Yahoo want bulk senders to have SPF, DKIM and DMARC together, with the DKIM domain matching your From address.
Finish Your Email Authentication
With DKIM in place, add the other two records with the SPF record generator and the DMARC record generator, then confirm all three pass with the email header analyzer. For the bigger picture, read our email marketing strategy guide, and if your website sends its own mail, see send email code in PHP and how hosting affects SEO.
Frequently Asked Questions
1Is it safe to create a DKIM private key in the browser?
Yes. The key is made by your browser's built in Web Crypto API, the same code browsers use for secure connections. Nothing is uploaded or stored, so copy or download the private key before you close the page.
2Should I use a 1024 or 2048 bit DKIM key?
Use 2048 bit. Google recommends it and RFC 8301 asks signers to use it. 1024 bit is the minimum Gmail accepts, so only use it if your DNS provider cannot save the longer record.
3What is a DKIM selector?
A short name that tells receivers which key to look up, so the record lives at selector._domainkey.yourdomain.com. You can pick any name. Using a new selector for each key makes rotation easy, because old and new keys can live side by side.
4Why does my DKIM check fail after adding the record?
Common causes are a DNS change that has not spread yet, a host name with the domain added twice, a key that was cut short or split wrongly, or a selector that does not match the one your server signs with. Paste the record into the checker above to see which part is wrong.