Free forever
DKIM RecordGenerator
Generate the DNS TXT record for DKIM email authentication. Paste your public key and configure your selector. DKIM signs the message itself, which is why it keeps passing when a message is forwarded and SPF does not.
14-day free trial · no credit card · cancel anytime
Common selectors: default, google, selector1, s1
Key Type
This free DKIM record generator formats the DNS TXT record that publishes your DKIM public key. Paste the public key from your mail server or sending service, set the selector, and copy both the record name and value ready for your DNS provider.
DKIM adds a cryptographic signature to every message you send. Receivers fetch the public key from your DNS at selector._domainkey.yourdomain.com and verify the signature, proving the mail was authorized by your domain and unmodified in transit. Unlike SPF, the signature survives forwarding, which makes DKIM the backbone of DMARC alignment.
The generator handles the part people get wrong: the exact record name, the v=DKIM1 syntax, and the key formatting. It does not create the key pair itself; keys come from wherever your mail is signed.
How it works
- 01Generate or locate your key pair in your sending service or mail server. Providers like Google Workspace, Microsoft 365 and every major ESP expose the public key in their admin area.
- 02Paste the public key into the generator, without the BEGIN and END header lines, and enter the selector your provider assigned or the one you chose.
- 03Choose the key type your provider uses. RSA is the default nearly everywhere; Ed25519 exists but is not yet verified by all receivers.
- 04Publish the generated value as a TXT record at the shown name, selector._domainkey.yourdomain.com, then trigger verification in your provider's dashboard.
When to use it
Use the generator when connecting a new sending service that hands you a raw public key instead of a ready-made record, when migrating DNS providers and re-creating records by hand, or when rotating DKIM keys on a schedule.
If your provider gives you a CNAME instead, publish the CNAME as-is; there is nothing to generate. CNAME delegation lets the provider rotate keys for you, which is strictly better when offered.
Common mistakes
Publishing at the wrong name
The record lives at selector._domainkey.yourdomain.com. Missing the _domainkey label, or entering the full name into a dashboard that appends the domain automatically, both produce a record receivers will never find.
Including the key header lines
The BEGIN PUBLIC KEY and END PUBLIC KEY lines are PEM armor, not key material. Pasted into DNS they corrupt the record; only the base64 body belongs in the p= tag.
Deleting the old key right after rotating
Mail signed with the old key is still in transit and still being verified for hours after you switch. Publish the new selector, move signing over, and retire the old record days later, not minutes.
Reusing one key across services
Each sending service should sign with its own selector and key. Sharing keys couples unrelated systems, and one leaked or misconfigured service forces a rotation everywhere at once.
Frequently asked questions
Does this generator create the DKIM key pair?
No. Key pairs are generated by whatever signs your mail: your ESP, Google Workspace, Microsoft 365, or your own server with a tool like opendkim-genkey. This tool formats the public half into a correct DNS record.
Where do I publish the generated DKIM record?
As a TXT record at selector._domainkey.yourdomain.com, where selector is the name shown next to the generated value. Many DNS dashboards want only selector._domainkey in the name field because they append the domain.
Should I pick RSA or Ed25519?
RSA with a 2048-bit key is the safe default and verified everywhere. Ed25519 produces much shorter records but some receivers still cannot verify it, so senders who adopt it publish both and sign twice.
Do I need a DKIM record for every sending service?
Yes. Each service signs with its own key under its own selector, and the records coexist under _domainkey without conflict. One domain routinely carries selectors for its mailbox provider, ESP and support tool at once.
Why does my DNS provider reject the record as too long?
A 2048-bit key exceeds the 255-character limit of a single TXT string, so the value must be split into two quoted strings. Most providers split automatically; for the rest, break the value anywhere inside the p= data.
Does DKIM alone stop spoofing?
No. DKIM proves a signature, but nothing forces receivers to require one from your domain until you publish a DMARC policy. Pair this record with DMARC, and use SPF alongside for the senders that support it.
From the blog
- Why Does My Email Say "via" Someone Else's Domain?Gmail prints that line when the domain that actually sent the message doesn't match your From address. One setting at your sending platform removes it.
- Why Are My Mailchimp Emails Going to Spam?Mailchimp owns the sending infrastructure but cannot prove the mail is yours. Three causes explain almost every campaign that lands in spam.
Related free tools
These tools answer the question once. Continuous monitoring re-checks your domain every 6 hours and alerts you when the answer changes, from $14/mo. Pricing · Guides · FAQ
This answers once. Monitoring answers every 6 hours.
LitInboxes re-checks DNS, DMARC, and blocklists on a schedule and emails you when the answer changes. Start with a 14-day free trial.
14-day free trial · no credit card · cancel anytime