DKIM Key Generator
Generate a real DKIM RSA key pair and DNS record in your browser. 2048-bit keys created locally — the private key never leaves your device. Free DKIM setup tool.
Generate a DKIM key pair
Keys are generated in your browser with Web Crypto — the private key never leaves your device.
What this DKIM key generator does
Common use cases
- 1Setting up DKIM signing on a new domain
- 2Rotating an old or compromised DKIM key
- 3Adding a new selector for a separate sending service
- 4Migrating DKIM to a self-hosted mail server
- 5Testing DKIM in a staging environment
- 6Meeting DMARC alignment requirements
Related tools
About DKIM
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send. Your mail server signs with the private key, and receivers verify the signature using the public key published in your DNS at selector._domainkey.yourdomain.com. A valid signature proves the message really came from your domain and wasn't altered in transit.
Use a 2048-bit key for modern security, keep the private key safe on your mail server, and pair DKIM with SPF and DMARC. To rotate keys, publish a new selector, switch signing to it, then remove the old record once traffic has drained.
More Free Tools Where This Came From
This utility is one of dozens of free, no-login tools for DNS, email, SEO and developers — all instant and private.
HostCloud.in · Pune, India · Serving 34,987+ Websites Since 2020
Got Questions? We Have Answers.
What is DKIM?
DKIM (DomainKeys Identified Mail) signs your outgoing email with a private key. Receivers verify the signature using a public key you publish in DNS, proving the message genuinely came from your domain and was not altered.
Are the keys generated securely?
Yes. The RSA key pair is created in your browser with the Web Crypto API. The private key is never transmitted to HostCloud or any server — it stays on your device.
Should I use a 2048-bit or 1024-bit key?
Use 2048-bit for modern security; it is the recommended standard. 1024-bit is legacy and only for systems that cannot handle a longer key.
Where do I publish the DKIM record?
Create a TXT record at selector._domainkey.yourdomain.com (for example default._domainkey.example.com) with the generated v=DKIM1 value. Then install the private key on your mail server.
My 2048-bit key is too long for one DNS string — what do I do?
DNS strings cap at 255 characters. Most providers split the value automatically; if yours does not, break the p= value into multiple quoted strings inside the same TXT record.
How do I rotate a DKIM key?
Generate a new key with a new selector, publish its DNS record, switch your mail server to sign with it, then remove the old selector once no mail is signed with the old key.