Free DKIM Record Generator
Generate cryptographically secure 2048-bit RSA key pairs, formatted DNS TXT records, and ready-to-install private keys directly in your browser. 100% private, zero network transmission.
100% Client-Side Privacy: Your cryptographic key pair is generated strictly inside your browser via the native Web Crypto API. Private keys are never sent to our servers or stored anywhere.
Your Generated DKIM DNS Records
Record Type: TXTFor Cloudflare, Namecheap, and GoDaddy, enter mail._domainkey. For registrars that do not automatically append your domain (e.g. AWS Route 53 or BIND), use the FQDN: mail._domainkey.example.com.
Note: 2048-bit keys exceed 255 characters. Modern DNS providers automatically handle string splitting behind the scenes. If your DNS provider strictly rejects strings over 255 characters, toggle to the BIND / Split Format or use 1024-bit.
/etc/dkimkeys/mail.private) with permissions restricted via chmod 400.How to Add DKIM TXT Records to Your DNS Registrar
Follow these simple registrar-specific instructions to publish your new DKIM public key record:
Cloudflare DNS
- Log in to Cloudflare and open your domain's DNS Records tab.
- Click Add record and choose Type:
TXT. - In Name, enter your selector prefix:
mail._domainkey. - Paste the complete single-line public key value into Content.
- TTL: Auto. Cloudflare automatically chunks the 2048-bit key under the hood.
AWS Route 53
- Open your Hosted Zone in Route 53 and click Create record.
- Record name: enter
mail._domainkey. - Record type:
TXT. - Value: Paste the TXT value enclosed in quotes (Route 53 allows split strings or auto-quotes).
- Click Save changes.
Namecheap Advanced DNS
- Go to Advanced DNS $\rightarrow$ Host Records.
- Click Add New Record and pick
TXT Record. - Host:
mail._domainkey. - Value: Paste the single-line public key value.
- TTL: Automatic. Click the green checkmark to save.
Installing the Private Key on Linux / Postfix
- Download your
mail.private.keyusing the button above. - Copy to
/etc/dkimkeys/mail.privateon your email server. - Set strict permissions:
chmod 400 /etc/dkimkeys/mail.private. - Update your
KeyTableandSigningTablein OpenDKIM. - Restart OpenDKIM and Postfix:
systemctl restart opendkim postfix.
Understanding DKIM (DomainKeys Identified Mail) & RFC 6376
DKIM (DomainKeys Identified Mail) is an internet standard defined in RFC 6376 that allows an organization to take cryptographic responsibility for an email message. When your sending mail server delivers a message, it calculates a hash of the email body and critical headers, encrypts that hash with your private key, and embeds it into the DKIM-Signature header.
When Gmail, Yahoo, or Outlook receives your email, it extracts the selector from the signature header, queries your domain's DNS for the public key at <selector>._domainkey.<domain>, and decrypts the hash. If the hashes match, the recipient server has cryptographic mathematical proof that:
- The email genuinely originated from the authorized owner of the domain.
- No man-in-the-middle or malicious proxy altered the headers or message content in transit.
Unlike SPF (which breaks when emails are forwarded by mailing lists or aliases), DKIM signatures survive email forwarding because the signature travels inside the message header itself.
Frequently Asked Questions About DKIM
Technical answers to common DKIM implementation, DNS, and deliverability questions.
What is a DKIM selector and what should I name it?
A DKIM selector is an arbitrary string that points recipient mail servers to the specific public key used to sign an email. You can have multiple selectors for different email providers or departments (e.g., mail, default, marketing, csmail). If this is your primary domain key, 'mail' or 'default' is standard.
Why do Google and Yahoo require 2048-bit DKIM keys in 2026?
1024-bit RSA keys are no longer considered cryptographically future-proof against modern computing capabilities. Major mailbox providers like Gmail and Yahoo Mail mandate 2048-bit DKIM keys for all commercial senders to prevent cryptographic forgery and spoofing.
How do I fix the 255-character DNS TXT string limit for 2048-bit keys?
A 2048-bit public key string is ~392 characters, which exceeds the RFC 1035 255-character limit for a single DNS string. Most modern DNS dashboards (Cloudflare, AWS Route 53, Namecheap, GoDaddy) automatically split long strings into 255-byte chunks behind the scenes. If you are using BIND or raw zone files, toggle the 'BIND / Split Format' option above to get RFC 4408 quoted chunks inside parentheses.
Is it safe to generate private keys in my web browser?
Yes! This tool utilizes the W3C Web Crypto API (crypto.subtle.generateKey), which executes natively inside your browser's local sandbox memory. The private key never leaves your machine, is never sent over any network, and is never logged on our servers.
How does DKIM work together with SPF and DMARC?
SPF specifies which IP addresses are authorized to send mail for your domain. DKIM attaches a cryptographic digital signature to the email header that verifies the message was not tampered with in transit. DMARC inspects both SPF and DKIM: if either authentication method passes and aligns with the 'From' header, your email passes DMARC and reaches the inbox.
Ready to scale your transactional & bulk email?
Get started with CentricSell Mail in minutes. Bring your existing AWS SES, SendGrid, or Mailgun credentials, or deploy onto your own dedicated VPS with verified SPF, DKIM, and rDNS.