DKIM signing needs two halves: a private key on the machine that sends, and the matching public key in DNS under a selector. Email platforms create both and show you the DNS record. If you run your own mail server, you make the pair yourself. This generator does it in the browser using the Web Crypto API, so the private key is created on your device and never transmitted.
What the generator does
Enter your domain, choose a selector (the tool suggests a date-based one), pick the key size and generate. You get:
- The DNS record:
v=DKIM1; k=rsa; p=<public key>with the exact host name to publish it under, plus a version split into 255-character quoted strings for DNS panels that need it. - The private key in PKCS #8 PEM format, shown on the page and downloadable, for your signer.
- The public key in PEM, for signers that want it in that form.
- A zone-file line for people who edit DNS by hand.
- A verification link that opens the DKIM checker with your domain and selector filled in, for after the record propagates.
Keys are generated with RSASSA-PKCS1-v1_5 and SHA-256, which is what DKIM signers expect, with the standard public exponent of 65537.
Publishing the record
| Field | Value |
|---|---|
| Type | TXT |
| Host / Name | selector._domainkey (becomes selector._domainkey.yourdomain.com) |
| Value | The generated v=DKIM1; k=rsa; p=... record |
| TTL | 3600 |
A 2048-bit public key makes the record about 400 characters, longer than a single DNS string. Most DNS panels split long TXT values automatically. If yours refuses the value, paste the quoted-strings version the generator shows; resolvers join the strings back together. Publish the record before you start signing, wait for DNS to propagate, and confirm it with the DKIM checker, which also reports the key length it found.
Installing the private key
The steps differ by signer, but the shape is the same:
- Copy the PEM file to the server, for example
/etc/opendkim/keys/yourdomain.com/mail202610.private. - Restrict it to the signer’s user:
chmod 600, owned byopendkimor the equivalent. - Tell the signer which selector and key to use for the domain: in OpenDKIM that is a
KeyTableandSigningTableentry; in rspamd adkim_signing.confdomain block; in Exchange or a commercial gateway, the DKIM signing screen. - Restart the signer and send a test message to a Gmail address.
- Open the message’s headers in the header analyzer and confirm
dkim=passwithheader.d=equal to your domain.
Sign with your organisational domain in the d= tag so the signature aligns with your From address; that alignment is what DMARC checks.
Rotation
Keys should be rotated once or twice a year, and immediately if a server is compromised. Because the selector is part of the record name, rotation is painless:
- Generate a new pair here with a new selector.
- Publish the new public key.
- Switch the signer to the new selector and private key.
- After a week, when mail signed with the old key has stopped being verified, remove the old record or set its
p=value to empty, which revokes it.
Both records can coexist in DNS during the switch; receivers look up whichever selector a given message names.
Troubleshooting dkim=fail
When a test message comes back with dkim=fail or no signature at all, the cause is almost always one of these:
- The record has not propagated, or was published under the wrong name. The host must be
selector._domainkey, not_domainkeyor the selector alone. The DKIM checker with your selector shows exactly what resolvers see. - Line breaks or quotes in the key. DNS panels that split long values sometimes insert spaces or stray quote characters. The checker reports the key length it parsed; anything other than 2048 (or 1024) means the value was mangled.
- The signer uses a different selector from the one you published. Compare the
s=tag in theDKIM-Signatureheader of the test message with the DNS record name. - The message was modified after signing. Footers added by a gateway, re-encoding by a mailing-list server or a downstream signature on forwarded mail break the body hash. Sign as late as possible in the outbound path and use relaxed canonicalisation (
c=relaxed/relaxed), which tolerates whitespace changes. d=does not match the From domain. The signature may verify but fail DMARC alignment. Sign with your organisational domain, not the hostname of the server.- The private key file is unreadable by the signer process. Check ownership and permissions, then the signer’s log; OpenDKIM reports a missing or unreadable key at startup.
Once dkim=pass appears with the right header.d=, publish or update DMARC and watch the aggregate reports in the DMARC report analyzer to confirm every path through your server signs correctly.
When not to use this tool
If your mail goes out through a platform, Google Workspace or Microsoft 365, that service already signs it and manages the keys. Generating your own pair would not help, because you cannot install the private key on their servers. Use the record they provide, publish it under the selector they specify (SendPulse uses sign, Google uses google, Microsoft uses selector1 and selector2), and verify it with the DKIM checker. This generator is for the mail you sign yourself.
Related records
DKIM is one of three. SPF names the servers allowed to send for your domain; build it with the SPF generator. DMARC ties both to the From address and tells receivers what to do when neither aligns; build it with the DMARC generator. The email authentication guide explains how the three fit together and the order to set them up.