DKIM Record Generator and Checker
Make a DKIM key pair in your browser and get the DNS record to publish. Then check any selector of any domain. Free, no sign-up, the private key never leaves this page.
The generator needs JavaScript.
Check a DKIM Record
Selector and domain are in every signed email: DKIM-Signature: … s=selector; d=domain.
What Is a DKIM Record?
DKIM signs each email with a private key on the sending server. The matching public key sits in DNS as a TXT record at selector._domainkey.yourdomain, so receivers can check that the message is unchanged and really comes from your domain.
The selector lets one domain have several keys: one per sending tool, and a new one for each rotation.
In the record
- v=DKIM1: the version; optional, but first if present
- k=rsa or k=ed25519: the key type
- p=: the public key; empty means revoked
- t=y: testing mode, to remove once it works
- The private key: never in DNS
RSA 2048, 1024 or Ed25519?
Take RSA 2048 unless your DNS panel can’t hold a long record.
| Key | Strength | Record length | Checked by |
|---|---|---|---|
| RSA 2048 | Recommended by Google; the default choice | About 400 characters: needs two 255-character strings | Every receiver |
| RSA 1024 | The minimum receivers must accept | Fits one string | Every receiver |
| Ed25519 | Short and strong | 44 characters | Not yet every receiver: sign with RSA as well |
Set Up DKIM on Your Own Server
For servers you run yourself, such as Postfix with OpenDKIM.
- 1
Generate the Pair
Choose domain, selector and key type above. The keys are made in your browser.
- 2
Publish the Public Key
Add the TXT record. If your DNS panel limits a value to 255 characters, use the split version.
- 3
Install the Private Key
Save the PEM file on the mail server, readable only by the signing service, and point its configuration at the selector.
- 4
Check and Send a Test
Run the checker, then send a message to Gmail and look for DKIM: PASS under “Show original”.
On a Platform, Use Its Key
A generated key only helps where you control the signing server. Email platforms sign with keys they make themselves.
- Account Engagement (Pardot). Pardot shows the DomainKey under Domain Management; its selector is 200608.
- Marketing Cloud Next. Salesforce gives you three DKIM CNAMEs (s1-e360-…) and manages the keys behind them.
- Google Workspace and Microsoft 365. Generate the key in the admin console (Google, selector “google”) or publish the two CNAMEs Microsoft shows (selector1, selector2).
More Free Tools
DKIM Generator FAQ
Short answers to what people ask about DKIM keys and records.
How do I create a DKIM record?
Generate a key pair, publish the public key as a TXT record at selector._domainkey.yourdomain with the value v=DKIM1; k=rsa; p=…, and install the private key on the server that signs your mail.
Is it safe to generate a DKIM key online?
Here the key is made by your browser’s own cryptography (WebCrypto) and never sent anywhere. For the strictest setups, generate it on the mail server itself, for example with opendkim-genkey.
What is a DKIM selector?
A name you choose that tells receivers which key to fetch. It appears as s= in the DKIM-Signature header and in front of ._domainkey in DNS.
Should I use 1024 or 2048 bit?
2048. Receivers must accept 1024 bit (RFC 8301), and Google recommends 2048. Use 1024 only if your DNS host can’t store the longer record.
How do I find the DKIM selector of a domain?
Open an email from that domain, show its headers and find DKIM-Signature: the s= value is the selector, d= the domain. DNS has no list of a domain’s selectors.
How often should I rotate DKIM keys?
Rotate on a schedule you can keep, and at once if a private key may have leaked. Publish the new key under a new selector, switch signing, and remove the old key once mail in transit has arrived.
Is anything I enter stored?
No. Keys are made in your browser and never sent. For the checker, your browser sends the DNS name to our server, which asks a public resolver; nothing is saved or logged.
We Make Salesforce Marketing Work for You
Talk to a certified consultant, not a salesperson, and leave the first call knowing your next step.