Email & DNS

DKIM Record Generator

Generate a DKIM key pair in your browser and get the DNS TXT record, the private key and ready-to-use OpenDKIM settings – or turn an existing public key into a record.

DKIM adds a digital signature to every message you send, so receivers can prove it really came from your domain and wasn’t changed on the way. Enter your domain and a selector, and the generator creates a 2048-bit RSA key pair right here in your browser – the DNS TXT record to publish, the private key for your mail server, and ready-to-paste Postfix + OpenDKIM settings. Already have a key? Paste the public key and get a correctly formatted record.

How to set it up

Pick a selector – a short name such as mail or s2026. It becomes part of the record name: mail._domainkey.example.com.
Generate, then download the private key and put it on the mail server that signs your mail (for OpenDKIM: /etc/opendkim/keys/<domain>/, readable only by opendkim).
Publish the TXT record at <selector>._domainkey in your DNS.
Restart the signer, send a test message and confirm with the SPF, DKIM & DMARC Checker – enter the same selector.

Rotating keys safely

Create the new key under a new selector and publish it before you switch the server over.
Switch signing to the new selector, then leave the old record in DNS for a week so mail already in transit still verifies.
Finally delete the old record – or publish it with an empty p= to revoke it.

Using Microsoft 365 or Google Workspace?

You don’t need to generate a key – both create and rotate it for you. Microsoft 365 uses two CNAME records (selector1 and selector2); Google Workspace gives you the TXT value under Apps → Gmail → Authenticate email.

Häufige Fragen

Is the private key sent anywhere?

No. The key pair is created with your browser’s built-in Web Crypto API and never leaves this page. Download it straight away – it isn’t stored and can’t be shown again.

Do I need this for Microsoft 365 or Google Workspace?

No – they create the key for you. In Microsoft 365 you add two CNAME records (selector1 and selector2) and switch DKIM on in Defender; in Google Workspace you generate the key under Apps → Gmail → Authenticate email. This generator is for your own mail server (Postfix + OpenDKIM, Exim, hMailServer…) or services that ask you for a key.

Which key size should I use?

2048-bit RSA. 1024-bit keys are considered weak and Gmail may ignore them; 4096-bit records are long enough that some DNS panels reject them.

Weitere Tools

Alle Tools →

Email & DNS