DKIM Key Generator

How do I generate a DKIM key?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

Generate an RSA key pair, keep the private key on the server that signs your mail, and publish the public key as a TXT record at selector._domainkey.yourdomain. This generator creates a 2048-bit or 1024-bit RSA key pair in your browser and formats the DNS record for you.

The key pair is created with the browser's Web Crypto API (RSA, public exponent 65537) and never leaves your machine. The private key is exported as an unencrypted PKCS#8 PEM (BEGIN PRIVATE KEY), which OpenDKIM, rspamd, Exim and most signing services accept.

Only RSA keys are generated. Ed25519 DKIM keys (RFC 8463) are shorter, but many receivers still verify only RSA, so RSA 2048 remains the safe default.

How do I set up DKIM with this generator?

Enter your domain and a selector. The selector is any short label; a date such as 2026a makes later key rotation easier.
Choose 2048-bit unless your DNS provider cannot store a long TXT record.
Install the private key in your mail server or signing service and configure it to sign with the same domain and selector.
Publish the TXT record at the host name shown, wait for DNS to update, then verify it with the DKIM checker and send a test message.

How to read the results

Private key (PEM): The signing key. Store it only on the signing server, readable by the signing service alone. Anyone who has it can sign mail as your domain.
DNS host: Where to publish the public key: selector._domainkey.yourdomain. Some DNS panels want only the part before your domain.
DNS record: The TXT value v=DKIM1; k=rsa; p=… where p is the base64-encoded public key (SubjectPublicKeyInfo).

Common DKIM setup mistakes

DNS provider rejects or truncates the 2048-bit record

A single TXT string holds at most 255 characters. Split the value into several quoted strings in one record; receivers join them back together.

"v=DKIM1; k=rsa; p=MIIBIjANBgkqh…" "…IDAQAB"

Record published at the wrong name

Panels that append your domain automatically turn selector._domainkey.example.com into selector._domainkey.example.com.example.com. Enter only selector._domainkey in those panels.

Selector in DNS doesn't match the signer

The s= tag in the DKIM-Signature header must match the selector you published. Check a received message's headers and compare.

Examples and command-line equivalents

Generate the same key pair with OpenSSL

The base64 output of the second command is the p= value.

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out dkim.private.pem
openssl pkey -in dkim.private.pem -pubout -outform DER | base64 -w0

OpenDKIM KeyTable and SigningTable

# /etc/opendkim/KeyTable
2026a._domainkey.example.com example.com:2026a:/etc/opendkim/keys/example.com/dkim.private.pem

# /etc/opendkim/SigningTable
*@example.com 2026a._domainkey.example.com

Check the published record

dig +short TXT 2026a._domainkey.example.com

Frequently asked questions

What selector name should I choose?

Any short label works. Many admins use a date such as 2026a so they can rotate keys by publishing a new selector without breaking mail signed with the old one.

Is a 1024-bit DKIM key still acceptable?

RFC 8301 requires verifiers to accept keys from 1024 to 4096 bits and says signers should use at least 2048 bits. Use 1024 only when your DNS provider cannot store the longer record.

How do I rotate a DKIM key?

Publish a new key under a new selector, switch the signer to it, and leave the old record in DNS for a week or so until mail signed with the old key has been delivered and verified. Then remove the old record.