DKIM Key Generator
?About this tool, how to use it, and FAQ▾
What is a DKIM key generator?
This tool generates a fresh RSA key pair for DKIM signing — 1024, 2048, or 4096-bit — and formats everything you need to deploy it: the private key for your mail server or sending service, the public key, and the exact DNS TXT record (name and value) to publish under your chosen selector.
Use it when setting up DKIM on self-hosted mail infrastructure, or when rotating keys on a schedule. Keep the private key secret; only the public half goes in DNS.
How to use
- Choose a key size — 2048-bit is the recommended default; 4096-bit works but some DNS providers need the record split into multiple strings.
- Optionally set a selector (defaults are fine; use dated selectors like 2026a if you rotate regularly).
- Generate, then install the private key in your mail server or sending service.
- Publish the DNS TXT record exactly as shown, wait for propagation, then verify with the DKIM checker.
Frequently asked questions
Is it safe to generate DKIM keys in a web tool?
The key pair is generated on the server per request and displayed only to you — nothing is stored. For high-security environments, generate keys on the signing host itself so the private key never crosses the network.
Should I use 1024, 2048, or 4096-bit keys?
2048-bit is the sweet spot: strong, universally supported, and fits in a single TXT string at most providers. 1024-bit is legacy-weak. 4096-bit adds margin but produces a record long enough that some DNS interfaces require splitting it.
How do I rotate DKIM keys without breaking mail?
Publish the new public key under a new selector, switch your mail server to sign with the new selector, and leave the old record up until mail signed with it has aged out (a few days), then remove it. Two selectors existing at once is normal and safe.