DKIM record generator

What is a Dkim Record Generator?

DKIM (DomainKeys Identified Mail) lets receiving mail servers verify that an email really came from your domain and was not altered in transit. Your mail server signs each outgoing message with a private key, and receivers fetch the matching public key from a DNS TXT record. This generator formats that DNS record correctly from your public key.

How to use it

  1. Enter your domain and selector, for example s1 or the selector your email provider gives you.
  2. Paste the public key, with or without the PEM header and footer.
  3. Copy the record name and value into your DNS provider.

Example

Record name: s1._domainkey.example.com
Type: TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

Record tags

  • v=DKIM1: version, must come first.
  • k=rsa: key type; ed25519 is also defined but less widely supported.
  • p=: the Base64 public key. An empty p= revokes the key.
  • t=y (optional): testing mode.

Practical tips

  • Use 2048-bit RSA keys. Some DNS providers need long values split into several quoted strings of up to 255 characters; most handle this automatically.
  • Google Workspace, Microsoft 365 and most email services generate the key pair for you and show the exact record to publish.
  • Rotate keys periodically by publishing a new selector before switching signing to it.
  • DKIM works best together with SPF and DMARC; Gmail and Yahoo require all three for bulk senders.
  • Verify with dig TXT s1._domainkey.example.com after publishing.

Frequently Asked Questions

What is a DKIM selector?

A label that lets one domain publish several DKIM keys. The selector appears in the email signature, so receivers know which DNS record to check.

Where do I get the DKIM public key?

From your email provider or mail server. Services like Google Workspace and Microsoft 365 generate it in their admin console.

My DNS provider rejects the long key. What can I do?

Split the value into several quoted strings of up to 255 characters each. Many providers do this automatically.

Do I need SPF and DMARC as well?

Yes. DKIM, SPF and DMARC work together, and major mailbox providers require them for bulk senders.

You May Also Need