DKIM Key Generator
Generate a DKIM public/private key pair and the DNS TXT record to publish for your selector.
Generate a DKIM key pair
This generator creates an RSA key pair: a public key formatted as a DNS TXT record to publish at selector._domainkey.yourdomain.com, and a matching private key you install on your mail server so it can sign outgoing mail. Keep the private key secret - anyone who has it can sign mail as you.
It's asymmetric crypto in practice. The private key stays on your server and creates the signature; the public key is published in DNS so receivers can verify it. An intercepted signature can't be used to forge future mail without the private key, and any change to a signed message fails verification. Most managed providers (Google Workspace, Microsoft 365) handle DKIM keys for you, so this generator is for setups where you run your own mail server.
Choosing your selector
The selector appears as s= in the DKIM-Signature header and as the DNS hostname. Publishing multiple selectors lets one domain hold several live keys at once, which is what enables zero-downtime rotation: publish the new selector, move the mail server onto it, then remove the old selector after propagation.
Common naming conventions are provider-based (google, sendgrid), date-based for rotation tracking (dkim202608, q3-2026), purpose-based (marketing, transactional), or generic (default, dkim, mail, s1). Any of them work - pick a scheme you'll remember.
1024-bit vs 2048-bit keys
2048-bit is the recommended default. The only reason to pick 1024-bit is a DNS provider with a hard character limit on TXT records.
| 1024-bit | 2048-bit (recommended) | |
|---|---|---|
| DNS TXT length | ~175 chars | ~350 chars |
| Security | Minimum acceptable, theoretically breakable | Infeasible to break, RFC 6376 recommended |
| Provider support | All | All modern providers (Cloudflare, GoDaddy, Route 53, ...) |
| Status | Being phased out | Industry standard |
Publish and configure it
Two halves: the public key goes in DNS, the private key goes on your mail server.
Testing your DKIM setup
After publishing, verify the DNS record with the DKIM checker, then send a test email to an inbox you control. View the original headers and look for dkim=pass in the Authentication-Results line.
Check alignment too: the d= domain in the signature must match your visible From domain, otherwise DKIM passes but still fails DMARC. Pasting the headers into the email header analyzer is the quickest way to confirm both at once.
Frequently asked questions
Where does each DKIM key go?
The public key goes in a DNS TXT record at selector._domainkey.yourdomain.com. The private key is installed on your mail server, which uses it to sign outgoing mail. Never publish the private key.
What is a DKIM selector?
A selector is a label that names a specific key, letting one domain publish several keys at once. It appears as s= in the signature and as the DNS hostname selector._domainkey.yourdomain.com. Multiple selectors are what make key rotation seamless.
What key size should I use?
2048-bit RSA is the current standard and the RFC 6376 recommendation. 1024-bit still works but is weaker; only choose it if your DNS provider limits TXT record length. 4096-bit can exceed DNS limits, so 2048 is the sweet spot.
Where do I add the record?
In your DNS provider's panel as a TXT record. On Cloudflare, Namecheap and GoDaddy paste the value directly; on AWS Route 53 wrap the whole value in double quotes. Propagation is usually 15 minutes to a few hours.
How do I verify DKIM works?
Look up your selector with the DKIM checker, then send a test message and confirm dkim=pass in the Authentication-Results header, with the d= domain matching your From domain.
Do I need this if I use Google or Microsoft?
Usually not - Google Workspace and Microsoft 365 generate and rotate DKIM keys for you inside their admin consoles. Use their keys, not this generator. This tool is for custom, self-managed mail infrastructure.
Next steps
Stop configuring DNS by hand
Cladiant provisions real Google Workspace, Microsoft 365, and Azure Entra mailboxes with SPF, DKIM, and DMARC written and verified on every domain before a single message sends. No DNS headaches, no authentication gaps, one invoice.