What a DKIM keypair is
DKIM (DomainKeys Identified Mail) is a way for your mail server to cryptographically sign every outgoing message, so receivers like Gmail and Outlook can verify the message really came from your domain and was not tampered with in transit. To do that, your mail server needs a keypair: a private key that lives on the server and signs each message, and a public key that you publish as a DNS TXT record at `<selector>._domainkey.<your-domain>` so receivers can fetch it.
This tool generates that keypair for you in your browser request, returns the PEM-encoded private key (which you install on your mail server) and the paste-ready TXT record (which you publish in DNS). RSA, 1024 / 2048 / 4096-bit, generated with Node's built-in crypto (OpenSSL bindings under the hood). We never store the key.
How to use it
- Pick a selector: a short label like `mail2024`, `s1`, or `google`. It identifies which key signed the message, so a new selector lets you rotate without breaking old mail.
- Choose a key length: 2048-bit is the modern default. 1024-bit is legacy (still accepted but discouraged). 4096-bit is overkill for almost everyone and slows down the signing path.
- Optional: enter your domain so we can show the full DNS name (`<selector>._domainkey.<your-domain>`). Without it you still get the TXT record body.
- Click Generate. We return the private key in PEM format and the TXT record value ready to paste into your DNS panel.
- Save the private key now. We never store it. Closing this tab loses it forever. Install it in your mail server (Postfix + opendkim, exim, MTA-STS, Mailgun, SendGrid, Postmark, your own SMTP) according to your provider's docs.
- Publish the TXT record at `<selector>._domainkey.<your-domain>` in your DNS. If your provider limits a single TXT string to 255 chars (most do, that is the RFC limit), use the split form we provide: `"part1" "part2"` on one line.
- Wait for DNS propagation (a few minutes to a few hours), then send a test mail and check the headers for `dkim=pass`. Gmail shows it under "Show original".
When this is useful
Six typical scenarios where you need a fresh DKIM keypair:
- Setting up DKIM for the first time on a new domain or new mail server. You need the keypair before you can configure either side.
- Key rotation every 6 to 12 months as a security hygiene practice. Generate a new selector, publish it, switch the signing key on the server, then retire the old selector after a grace period.
- Suspected key compromise: if you think the private key leaked (server breach, accidental commit to a public repo, ex-admin still has access), generate a new one immediately and revoke the old by emptying its `p=` value.
- Adding a second sending source (a transactional provider like SendGrid alongside your own Postfix). Each source typically wants its own selector and key.
- Moving from a 1024-bit legacy key to a 2048-bit modern key. Most providers warn loudly about this in 2026.
- Testing DKIM on a staging domain before flipping it on for production mail.
Related tools: Email DNS checker (verify your published record), DNS lookup, Mail header analyzer.