Learn
Documentation How To Blog Deliverability GuideFree Tools
Subject Line Tester SPF Checker & Generator DMARC Record Generator DMARC Checker DKIM Checker & Generator Email Header Analyzer MX Lookup MTA-STS Checker & Generator BIMI Checker & Generator Email Deliverability Test Email Spam Checker Email Template BuilderDKIM Record Generator
Generate a DKIM key pair and the DNS TXT record to publish for it. The key is created in your browser and never sent to us.
Generate a DKIM key pair
Enter the domain you send from and pick a selector. You get the DNS record and the private key for your mail server.
1. Add this TXT record to your DNS
Name / host
Many DNS providers add your domain to the name for you. If yours does, enter only the part before your domain.
Value
DNS provider rejects the value? Use the split version
A single DNS string holds 255 characters. Most providers split a longer value for you. If yours does not, paste the value as quoted strings:
For a BIND zone file:
2. Install the private key on your mail server
3. When DNS has updated, check the record with the DKIM checker.
How a DKIM record works
What is a DKIM record?
DKIM (DomainKeys Identified Mail) signs every message you send. Your mail server signs with the private key. Receivers read the selector from the signature, fetch the public key from your DNS, and check that the message came from you and was not changed on the way.
The DKIM record is a TXT record at selector._domainkey.yourdomain.com. Its value has three parts: v=DKIM1 is the version, k=rsa is the key type and p= is the public key.
Where to paste it
Open the DNS settings for your domain at your registrar or DNS host, such as Cloudflare, Route 53 or Namecheap. Add a new record of type TXT. Put the name in the host field and the full value in the content field.
Then point your mail server at the private key and the same selector. In OpenDKIM that is the KeyFile and Selector settings, or a line in the KeyTable. The selector in the server config must match the record name, or every signature will fail.
You might not need this tool
If you send through Amazon SES, Postmark or Mailgun, they generate the DKIM key for you and keep the private key on their side. You add the records they show you in their dashboard, often CNAMEs, and you are done. A key from this page would not be used.
This generator is for mail you sign yourself: your own MTA, a self-hosted server with Postfix and OpenDKIM or Rspamd, or an app that signs messages in code.
Long records and 255-character strings
A 2048-bit key makes a TXT value of about 410 characters. DNS stores TXT data as strings of up to 255 characters each, and one record can hold several of them. Receivers join the strings back together before they read the key.
Cloudflare, Route 53 and most other hosts split a long value for you when you paste it. Some older control panels do not, and reject it or cut it off. For those, use the split version above, with each part in its own quotes and a space between them.
Is the private key sent to your server?
No. The key pair is created by the Web Crypto API built into your browser. Nothing you type and nothing it generates is sent to us. Close the tab and the key is gone, so copy it to your mail server first.
Do I need to generate my own DKIM key?
Only if you sign mail yourself. Amazon SES, Postmark, Mailgun, SendGrid and most other email providers create the key for you and give you the DNS records to add. You need your own key when you run the mail server, for example Postfix with OpenDKIM or Rspamd.
Should I use a 2048-bit or 1024-bit key?
Use 2048 bits. Gmail, Yahoo and Microsoft recommend it, and 1024 bits is the minimum receivers accept. Pick 1024 only if your DNS provider cannot publish a TXT record longer than 255 characters.
What selector should I use?
Any short name made of letters, numbers, dots or dashes. Many people use s1, mail, or a date such as 202610. A new selector for each new key lets you rotate keys without downtime: publish the new record, switch the server to it, then remove the old one.
Will this private key work with OpenDKIM and Rspamd?
Yes. The key is a standard PEM file in PKCS#8 format (BEGIN PRIVATE KEY). OpenDKIM, Rspamd, Haraka, Exim and Postfix tools that use OpenSSL read it. Save it with permissions that only the signing service can read.
How often should I rotate DKIM keys?
Every six to twelve months is a common practice, and at once if the private key may have leaked. Generate a new key under a new selector, publish it, move signing over, and delete the old record a few days later.
After DNS propagates, confirm the key with the DKIM checker. DKIM is one of three records, so run the DMARC checker to test SPF, DKIM and DMARC together. For DMARC to pass on DKIM, the signing domain must match your From domain. That is DKIM alignment.
Own your email platform
Broadcast is self-hosted email marketing software. It watches your SPF, DKIM and DMARC records and tells you when one breaks. Pay once, run it on your own server.
Choose Your License
One-time payment, unlimited emails forever
"I was tired of spending hundreds per month on Beehiiv to send emails. […] Then I found Broadcast and now I can scale at my own pace without burning money I worked hard for."
@bensnichedsitesRegular License Most popular
One server, for your own business
$150
$250
Agency License
Up to 5 servers, for client work
$450
Extended License
Up to 25 servers, for many clients
$1,000
Every license has every feature, unlimited subscribers and all 2.x updates.