DKIM DNS Record Generator

Generate the DNS TXT record needed to publish a DKIM (DomainKeys Identified Mail) public key. Paste a PEM or raw base64 public key, set your selector and key type, and get the ready-to-publish DNS host (selector._domainkey) and TXT value (v=DKIM1; k=rsa; p=…). Optionally generate a fresh 2048-bit RSA keypair with WebCrypto — the private key never leaves your browser.

How to use the DKIM DNS Record Generator

You need your DKIM public key in PEM or base64 format. How to get it depends on your setup:

  • Most mail services (Google Workspace, Microsoft 365, SendGrid) show you the DNS record directly in their admin UI — you may not need this tool at all for those. Use it if you generate your own keypair.
  • Self-managed MTA (Postfix, Exim, OpenDKIM): run opendkim-genkey -s selector -d yourdomain.com — it writes selector.private and selector.txt. Paste the public key from the p= field in selector.txt here.

Or click Generate RSA Keypair to create a fresh 2048-bit RSA key in your browser (WebCrypto). The public key fills the textarea automatically; the private key is shown below with a reminder to store it securely — it is needed by your mail server to sign outgoing messages.

Set your selector — any alphanumeric string (commonly the year, google, s1, mail). The selector is part of the DNS host: selector._domainkey.yourdomain.com. Set testing mode (t=y) while validating — it tells receivers not to enforce DKIM failures yet.

Click Generate Record. The output shows the DNS host, the TXT value, and a BIND-compatible version with the base64 split into 255-character quoted strings (required by most DNS servers).

About DKIM Records

DKIM (DomainKeys Identified Mail, RFC 6376) is an email authentication method that adds a cryptographic signature to outgoing messages. Your mail server holds a private key and uses it to sign a hash of selected headers and the message body. The signature is included in a DKIM-Signature: header. When the receiving server gets the message, it retrieves the corresponding public key from DNS (at selector._domainkey.yourdomain.com) and verifies the signature. If the verification passes, the message body and headers were not altered in transit.

DKIM alone does not prevent spoofing of the visible From: header — a phisher can DKIM-sign a message with their own domain while showing your domain in From:. That is why DMARC (Domain-based Message Authentication, Reporting, and Conformance) is needed alongside DKIM: DMARC checks that the DKIM d= domain aligns with the From: header domain. Together, SPF + DKIM + DMARC provide strong anti-spoofing coverage.

The DNS record format is v=DKIM1; k=rsa; p=<base64-public-key>. The p= value is the base64 DER encoding of the SubjectPublicKeyInfo structure (the same bytes as the body of a PEM public key file). Many DNS providers limit TXT records to 255 characters per string — long RSA keys (2048-bit) produce a ~392-character base64 value, which must be split into multiple quoted strings in a BIND zone file: "chunk1" "chunk2". DNS resolvers automatically concatenate the strings. This tool outputs the split format for BIND and the single-string format for control panels that handle splitting internally.

Common use cases

  • Self-managed mail server setup — generate a keypair, configure the private key in OpenDKIM or Postfix, and publish the DNS record from the public key output.
  • Key rotation — DKIM best practice recommends rotating keys every 6-12 months. Generate a new keypair under a new selector, publish it, update your MTA config, then remove the old selector after a TTL.
  • Testing and staging — use testing mode (t=y) on a new selector while verifying the signature is working before switching to enforce mode.
  • Multi-domain DKIM — generate separate records per domain if you sign mail for multiple domains from the same infrastructure.
  • Verifying an existing key — paste a public key from your MTA config to double-check that the base64 is well-formed before publishing the DNS record.

Frequently asked questions

What is a DKIM selector?
The selector is an arbitrary label that forms part of the DNS lookup path: selector._domainkey.yourdomain.com. It allows you to have multiple DKIM keys at once — useful during key rotation (old and new selectors both exist in DNS simultaneously) or for different outbound mail services (e.g. google._domainkey for Google Workspace, sg._domainkey for SendGrid).

What is the difference between RSA and Ed25519 DKIM keys?
RSA (typically 2048-bit) is the universal default — every mail server supports it. Ed25519 is a modern elliptic-curve signature scheme: the keys are much shorter (43-character base64 public key vs ~392 for RSA-2048) and computationally faster, but not all mail servers support it yet. RFC 8463 added Ed25519 support in 2018; support is now widespread but not universal. You can publish both simultaneously under different selectors.

Why does my DKIM TXT record need to be split into 255-char strings?
RFC 1035 limits each DNS TXT string segment to 255 bytes. A 2048-bit RSA public key produces a base64 value of ~392 characters, which exceeds this limit. In zone files (BIND), you enclose multiple strings in quotes and separate them with spaces — the DNS protocol concatenates them automatically on lookup. Most web-based DNS control panels handle the split internally, so you can paste the full value.

I generated a keypair — where does the private key go?
The private key must be installed on the mail server that signs outgoing email. For OpenDKIM, it goes in the path referenced by KeyFile in opendkim.conf. For Postfix with Milter, the same. The file should be readable only by the mail daemon user. Never share or expose the private key — anyone with it can forge DKIM-signed email from your domain.

What does testing mode (t=y) do?
Adding t=y to the DKIM DNS record signals to receivers that the key is in testing mode. Receivers that support this flag should not enforce DKIM failures (i.e. they should not use DKIM result to influence spam scoring negatively). It is useful when you are deploying DKIM for the first time and want to verify signatures are correct before enabling enforcement.