Generate a DKIM keypair in your browser — private key never leaves your device.
Pick a selector + key size, hit Generate. The keypair is built locally via WebCrypto — the private key never touches a network. Paste the public-key TXT record into your DNS and the PEM into your mail server.
Generation runs in your browser via WebCrypto. No network call is made; the private key never leaves your device.
Generate a keypair to see the TXT record + private key.
DKIM (DomainKeys Identified Mail) signs every outbound message with a private key your mail server holds. The matching public key is published as a DNS TXT record at <selector>._domainkey.<your-domain>. The receiver verifies the signature against the public key — if it matches, the message provably originated from someone with access to your private key.
DKIM is the strongest of the three sender-auth standards because it survives forwarding: an SPF check fails the moment a mailing list re-sends your message from its own IP, but the DKIM signature stays valid as long as nobody mutates the signed headers + body. That's why DMARC alignment via DKIM is generally more reliable than alignment via SPF.
2048-bit RSA is the modern default. Google + Microsoft both downrank or reject 1024-bit keys in 2024+. The longer key produces a longer DNS TXT record (~410 chars), which some DNS providers force you to split into 255-char "strings" — the generator shows both formats so you can paste whichever your provider accepts.
Rotating keys: publish a new selector with a new keypair (e.g. selector "k2" alongside the old "k1"), switch your mail server to sign with the new key, leave the old record in DNS for a week so any in-flight delayed messages still verify, then delete the old one. Most providers recommend rotating every 6–12 months.
In your browser via the WebCrypto API. No data is sent over the network — the keypair never leaves your device unless you copy it yourself.
A short label that disambiguates multiple DKIM keys on the same domain. The TXT record lives at <selector>._domainkey.<your-domain>. Common selectors: default, mail, google, k1, s1.
Gmail + Outlook both downrank 1024-bit keys and may eventually reject them. 1024 is only useful for legacy mail systems that can't process the longer TXT record.
Use the split format the tool shows — most providers accept the same record broken into 255-character strings concatenated together.
Into your outbound mail server config — opendkim (KeyFile), Postfix milter, Mailgun "private key" field, AWS SES verified identity, etc.
SieveGuard's Domain Health add-on probes 14 common DKIM selectors on every domain you ingest and alerts when keys disappear, get revoked, or shrink below 2048 bits. Free during your trial.