DKIM record generator
Pick a selector, enter your domain, and get a 2048-bit key pair with the DNS record to publish. Your browser makes the keys, and the private key never leaves this page.
The short version
- You get the TXT host, the TXT value, a split version for DNS panels that need it, and the private key in PEM.
- Keys are made with WebCrypto in your browser. Nothing is sent to ZapBounce, so the private key is yours alone.
- Save the private key before you leave: it isn't stored anywhere.
- After publishing, confirm the record with the DKIM checker, then watch your DMARC reports for passing mail.
What the generator makes
Pressing Generate asks your browser's WebCrypto API for an RSA key pair with the public exponent 65537 and SHA-256, the signing setup RFC 8301 sets for DKIM. The public half is exported as base64 and dropped into the p= tag of the record. The private half is exported in PKCS#8 and wrapped in PEM, which OpenDKIM, Postfix, Exim and most sending tools accept.
A 2048-bit key makes a TXT value of about 400 characters. DNS stores TXT data in strings of up to 255 characters, so the tool also prints the value as quoted chunks. Paste that form into BIND zone files or Route 53. Cloudflare and most web panels take the single line and split it for you.
| Tag | Value | Meaning |
|---|---|---|
| v | DKIM1 | The record version. It must come first |
| k | rsa | The key type |
| t | y (optional) | Testing mode: receivers should not treat failures as final |
| p | base64 public key | What receivers use to check your signature |
Tags from RFC 6376, section 3.6.1.
Publishing the record and rotating keys
Create a TXT record at selector._domainkey.yourdomain with the value shown. Then install the private key on the server that signs your mail, using the same selector. Our DKIM checker reads the record back once DNS has caught up.
Pick a selector that says when the key was made, such as s2026. When you rotate, publish the new key under a new selector, switch signing over, and leave the old record up for a week or so while mail in transit is still checked against it. Then remove it.
DKIM is one of the two checks DMARC looks at, alongside SPF. With a key in place, build your policy with the DMARC generator and read the results in the DMARC report analyzer.
Questions people ask
How do I generate a DKIM record?
Enter a selector and your domain above and press Generate keys. You get a TXT record to publish at selector._domainkey.yourdomain and a private key to load into the server that signs your mail.
Should a DKIM key be 1024 or 2048 bits?
Use 2048 bits. RFC 8301 requires signers to use at least 1024 bits and recommends 2048. Choose 1024 only when your DNS host can't store a TXT value longer than 255 characters.
Is it safe to generate a DKIM private key online?
It is with this generator, because the key pair is made in your browser by WebCrypto and nothing is sent to a server. Save the private key when it appears; reloading the page makes a new pair.
Do I need to generate DKIM keys if I use Google Workspace or Microsoft 365?
No. Hosted platforms generate the key for you and show you the record to publish. A generator like this one is for servers and tools you run yourself, such as Postfix with OpenDKIM.
Signed mail still needs a live inbox
Authentication proves the mail is yours. ZapBounce checks that each address on your list can receive it, and unknowns are never billed.