Generate a DKIM keypair in your browser — private key never leaves your device.
Pick a selector + key size, hit Generate. The keypair is built locally via WebCrypto — the private key never touches a network. Paste the public-key TXT record into your DNS and the PEM into your mail server.
Generation runs in your browser via WebCrypto. No network call is made; the private key never leaves your device.
Generate a keypair to see the TXT record + private key.
The keypair is generated in your browser and never leaves it. You publish the public half as a DNS TXT record under a selector you choose; your mail server signs with the private half.
2048-bit is the default because Gmail and Outlook both treat 1024-bit as weak. A 2048-bit public key does not fit in one 255-byte DNS string, so the generator shows both the single-string and split-string forms — paste whichever your DNS provider accepts.
In your browser via the WebCrypto API. No data is sent over the network — the keypair never leaves your device unless you copy it yourself.
A short label that disambiguates multiple DKIM keys on the same domain. The TXT record lives at <selector>._domainkey.<your-domain>. Common selectors: default, mail, google, k1, s1.
Gmail + Outlook both downrank 1024-bit keys and may eventually reject them. 1024 is only useful for legacy mail systems that can't process the longer TXT record.
Use the split format the tool shows — most providers accept the same record broken into 255-character strings concatenated together.
Into your outbound mail server config — opendkim (KeyFile), Postfix milter, Mailgun "private key" field, AWS SES verified identity, etc.
SieveGuard's Domain Health add-on probes 14 common DKIM selectors on every domain you ingest and alerts when keys disappear, get revoked, or shrink below 2048 bits. Free during your trial.