DKIM Key and Record Generator
Generate a 2048-bit DKIM key pair in your browser and get the TXT record name and value, split for zone files, plus the private key for your mail server.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a DKIM key and DNS record
Output
No key yet
Press the button to generate a key pair in this browser.
The key pair is generated by this browser's Web Crypto and never leaves it. The public half goes in DNS; the private half goes to whatever signs your mail (OpenDKIM's KeyFile, Postfix with rspamd, or the provider's console). 2048-bit is the size RFC 8301 recommends; a 2048-bit record is longer than one 255-byte TXT string, so it is split into several, which DNS joins back together.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Key size and rotation
RFC 8301 requires verifiers to support 2048-bit keys and recommends signers use at least 1024; 2048 is the norm. Rotate keys by publishing a new selector, switching the signer to it, and removing the old record a few days later once mail signed with it has been delivered. A date in the selector name keeps track.
When not to generate your own
Hosted senders such as Google Workspace, Microsoft 365, SES, SendGrid and Postmark generate the key for you and give you a record or a CNAME to publish. Generate your own only for a mail server you run.