BYTETOOLS

DKIM Record Generator

Generate a DKIM TXT record from your public key, or create a fresh 2048-bit RSA key pair in the browser. Output as one flat line and as BIND chunks.

Public key

Key generation uses your browser’s built-in Web Crypto. The private key is created on this device, is never transmitted, and disappears when you close the tab — copy or download it before you leave.

—
Key size
28 chars
Record length
1
TXT strings needed
single TXT
Publish at

TXT record for mail._domainkey.example.com

Paste a public key above, or click “Generate key pair”, and the finished DKIM record appears here.

What each tag does

  • v=DKIM1 — version, and it must come first.
  • k=rsa — key algorithm. rsa is the safe choice; ed25519 needs RFC 8463 support at the verifier.
  • h=sha256 — the hash algorithms a verifier may accept for this key.
  • p=… — the base64 SubjectPublicKeyInfo. An empty p= tells verifiers the key has been revoked.

What is the DKIM Record Generator?

The DKIM Record Generator turns a public key into the DNS TXT record that mailbox providers read when they verify your signatures.

  • Generates 1024-, 2048- or 4096-bit RSA key pairs with Web Crypto, entirely on your device
  • Accepts any existing SubjectPublicKeyInfo PEM and strips the armour for you
  • Emits both a flat single-line value and the 255-character quoted BIND form
  • Toggles for h=sha256, s=email and the t=y testing and t=s strict flags
  • Warns about weak 1024-bit keys and refuses to put a private key in the record
  • Every tag explained in plain English under the output

How to use the DKIM Record Generator

  1. 1

    Enter your signing domain and pick a selector — anything unique will do, and dated names like s2026a make rotation easy.

  2. 2

    Paste your existing public key PEM, or choose a key size and click “Generate key pair” to make a new one in the browser.

  3. 3

    If you generated a key, copy or download the private key straight away and install it on your mail server.

  4. 4

    Set the k, h, s and t tags to taste — sha256-only and s=email are the usual hardening choices.

  5. 5

    Copy the flattened value into your DNS panel, or the BIND line into your zone file, at selector._domainkey.yourdomain.

About the DKIM Record Generator

The DKIM Record Generator turns a public key into the DNS TXT record that mailbox providers read when they verify your signatures. Paste the BEGIN PUBLIC KEY block from your mail server, or let the tool generate a brand-new RSA key pair with your browser's built-in Web Crypto — the private key is created on your device and never leaves it.

You get the record two ways: a single flattened line for hosted DNS panels such as Cloudflare or Route 53, and the BIND zone-file form split into 255-character quoted strings, because a 2048-bit key never fits in one TXT string. The v, k, h, s, t, n and p tags are each explained under the output.

All key generation and encoding runs locally in your browser. Nothing is uploaded, nothing is logged, and if you generate a key pair you must copy or download the private key before you close the tab — it exists only in that page.

Frequently asked questions

What is a DKIM record?

It is a DNS TXT record published at selector._domainkey.yourdomain that holds the public half of your signing key. When a receiving server sees a DKIM-Signature header, it fetches this record and uses the p= value to check that the signature really came from your domain.

What is a DKIM selector and what should I call it?

A selector is just a label that lets a domain publish several keys at once. Any name works — mail, default, s1, or a dated one like s2026a. Dated selectors make rotation painless: publish the new key under a new selector, switch your signer over, then remove the old record.

Should I use a 1024-bit or 2048-bit DKIM key?

Use 2048 bits. 1024 was the old minimum and is now considered weak, and every major mailbox provider accepts 2048. The only reason to stay at 1024 is a DNS host that cannot store a TXT value long enough, which is rare today.

Why is my DKIM record split into two quoted strings?

A single character-string inside a TXT record cannot exceed 255 bytes, and a 2048-bit key is longer than that. The record is therefore published as two adjacent quoted strings, which resolvers concatenate with no separator before the verifier ever sees them.

Is the private key sent to a server when I generate a key pair?

No. The key pair is created by your browser's Web Crypto implementation inside the page, and neither half is transmitted anywhere. Because of that, the private key disappears the moment you close or reload the tab — download it first.

What does an empty p= tag mean?

An empty p= revokes that selector. Verifiers treat any signature using it as failed. It is the correct way to retire an old key once you have moved to a new selector, rather than deleting the record outright.

Related tools