A selector lets a domain use multiple DKIM keys at once. It becomes part of the DNS record name: selector._domainkey.yourdomain.com.

DKIM Record Generator

Generate a DKIM key pair and the DNS TXT record needed to sign your outgoing email. Keys are created entirely in your browser — your private key is never sent anywhere.

100% Free Generated Locally Nothing Sent To Our Server

Generate DKIM Key Pair

Your Domain (optional, for reference)

Selector

A short label identifying this key, e.g. "default" or a date like "oct2026".

Key Size

Generating RSA key pair in your browser — this can take a few seconds for 2048-bit keys...

Save your private key now. It was generated locally in your browser and is never stored or transmitted anywhere. If you navigate away or refresh this page, it is gone permanently and you'll need to generate a new key pair.

DNS TXT Record — add this at your DNS provider

Private Key — add this to your mail server / ESP's DKIM signing config

How to add this: Create a new TXT record with the host/name shown above (some DNS providers want just the selector and _domainkey part without your domain, since they append it automatically — check your provider's docs) and paste the TXT value exactly as shown. Then configure your mail server or email service provider to sign outgoing mail with the private key above, using the same selector.

Key pair generated entirely in your browserYour private key is created locally using the Web Crypto API and never transmitted anywhere.

Private key never leaves your deviceGenerated and displayed locally — it is never sent to or stored on our servers.

Nothing storedWe have no record of any key pair you generate here.

No third-party sharingYour keys are never shared with ads, trackers, or outside services.

Works offlineKey generation happens entirely client-side, so it works even without an internet connection.

About DKIM Record Generator

What Is a DKIM Generator?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails, letting receiving servers verify the message genuinely came from your domain and wasn't altered in transit — a key part of modern email authentication alongside SPF and DMARC.

How Our DKIM Generator Works

The tool generates a DKIM key pair and the corresponding DNS TXT record you need to publish, formatted correctly for your DNS provider.

How to Use the DKIM Generator

Enter your domain and selector
Click Generate
Publish the generated TXT record in your DNS
Configure your mail server to sign outgoing mail with the matching private key

Key Features

Correctly formatted DNS record — ready to publish directly
Improves email deliverability — properly signed mail is less likely to be flagged as spam

Who Uses This Tool

Email administrators setting up authentication for a domain that sends email. Developers configuring transactional email systems.

Frequently Asked Questions

Do I need DKIM if I already have SPF?
Yes — SPF and DKIM verify different things and work best together, with DMARC building on top of both for full authentication.

Is this tool free?
Yes, generating a DKIM record is completely free.

Frequently Asked Questions

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email using a private key. Receiving servers look up your public key in DNS and verify the signature, confirming the message really came from your domain and wasn't altered in transit.

Is it safe to generate a private key in a browser tool?

Yes — this tool uses your browser's built-in Web Crypto API to generate the key pair locally. The private key never leaves your device or touches our server; it exists only in this browser tab's memory until you copy it or navigate away.

What is a selector?

A selector lets a domain use multiple DKIM keys at once (e.g. one per sending service). It becomes part of the DNS record name: selector._domainkey.yourdomain.com. Common choices are "default", a service name, or a date for easy key rotation.

Which key size should I choose?

Use 2048-bit for any new setup — it's the current standard, offers strong security, and is well supported everywhere. 1024-bit is weaker and only worth using if a legacy system requires it. 4096-bit is stronger still, but the DNS record it produces is long enough that some DNS providers and mail servers don't handle it correctly — only use it if you've confirmed your DNS provider and mail server both support it.

My DNS provider says the TXT record is too long.

Some providers limit a single TXT string to 255 characters. A 2048-bit DKIM key's record exceeds this, so it needs to be split into multiple quoted strings that DNS concatenates automatically — check your provider's documentation for "long TXT record" support, or try a 1024-bit key as a fallback.

Does DKIM alone stop spoofing?

Not by itself. DKIM proves message integrity and authenticity but doesn't tell receivers what to do if a message fails the check. Pair it with SPF and a DMARC policy for enforcement.