DKIM Record Generator
The RSA key pair is created inside your browser through WebCrypto. You publish the public half in DNS; the private half stays with you and is never sent to our server.
Any name made of letters and digits. Including a date helps — mail2026, for instance — so the next rotation is unambiguous.
The key is created inside your browser using WebCrypto. The private half is never sent to a server and is not stored anywhere — close the page and it is gone.
How DKIM works
Your mail server signs each outgoing message with the private key and adds the signature in a DKIM-Signature header. The receiver reads the selector name from that header, fetches the matching public key from your DNS, and verifies the signature. A match means the message came from your domain and was not altered in transit.
Which leads to a simple consequence: exactly one party needs the private key — whoever sends the mail. Everything else is public.
What to do with the output
- Publish the public key as a TXT record at
selector._domainkey. - Store the private key on your mail server and point the signing configuration at it.
- Send a test message and read its headers:
Authentication-Resultsshould showdkim=pass.
The usual publishing problem
A 2048-bit key does not fit in a single TXT string, since DNS caps a string at 255 characters. Most panels split the value automatically, but some expect you to do it — the record then becomes several quoted strings in a row with no separator. If a key check afterwards reports that the key cannot be parsed, the value has almost certainly been broken by a line wrap or truncated during copy-paste.
Questions
Nearby
Signing is set up — now the list
DKIM proves a message is yours and unaltered. It still will not reach an address that does not exist. uChecker cleans your list before you send — the first 100 addresses are free.
Check your list