DKIM Key Generator

About this tool

DKIM adds a digital signature to outgoing email. Your mail server signs each message with a private key, and receivers verify the signature with the matching public key, which you publish in DNS as a TXT record named selector._domainkey.yourdomain. This tool generates the key pair in your browser with the Web Crypto API: choose a selector (any name, handy for rotating keys, for example a year or date), pick RSA 2048 (recommended and supported everywhere), or Ed25519 (a small key defined in RFC 8463 that not every receiver verifies yet), and optionally mark the key as testing with t=y. You get the DNS value, split into 255-character parts if your provider needs that, and the private key in PKCS#8 PEM form to download or copy. The private key is created on your device and is never sent anywhere or stored, so save it before you leave the page. Keys were checked by signing a real message with the generated private key and verifying it against the generated DNS record using an independent DKIM implementation. Many email services generate keys for you; use this tool when you run your own mail server or your provider asks you to bring a key.

How to use it

1. Choose a selector, for example a year or date so you can rotate keys later.
2. Press Generate key pair and wait a moment (RSA 2048 takes a second or two).
3. Publish the TXT record at the host shown, and save the private key somewhere safe.
4. Give the private key to your mail server, then check the record with the email authentication checker by entering the selector.

Common problems

The DNS provider rejects the long value

RSA keys are longer than one 255-character DNS string. Most providers split it automatically; if yours does not, enter the parts shown below the value in order.

Receivers say the signature does not verify

Check that the selector and domain in your mail server's signing settings match the record host exactly, and that the private key is the one generated with this record.

Is it safe to generate a private key in a web page?

The key is made by your browser and never leaves the page, but the safest practice is to generate keys on the machine that will use them. Treat the key as a password and rotate it if you suspect exposure.