Generating an a=rsa-sha256 key for DKIM involves using OpenSSL. The process typically starts with the command `openssl genrsa -out <your_domain>.private <key_length>`, where `<key_length>` is either 1024 or, more commonly, 2048 for better security. This generates a private key that must be securely stored. To extract the corresponding public key, the command `openssl rsa -in <your_domain>.private -pubout -out <your_domain>.public` is used. This public key is then added to your DNS records. Key length impacts security, with longer keys providing greater security. Be cautious when using online DKIM generators; it is safer to use OpenSSL locally. Many ESPs recommend dkimcore.org for additional information. RFC 6376 specifies the use of RSA for DKIM.
8 marketer opinions
Generating an a=rsa-sha256 key for DKIM primarily involves using OpenSSL. The common command is `openssl genrsa -out <your_domain>.private <key_length>`, where `<key_length>` is either 1024 or 2048 (2048 is recommended for better security). This generates a private key, which must be securely stored. A corresponding public key is then extracted for placement in your DNS records. Caution is advised when using online DKIM generators; creating keys locally using OpenSSL is generally recommended.
Marketer view
Marketer from Email Geeks shares that for key length, the maximum length equals maximum security.
18 Jan 2024 - Email Geeks
Marketer view
Marketer from Email Geeks suggests being cautious when using websites to generate DKIM keys, and advises to use OpenSSL to create a script for generating your own keys.
8 Jun 2022 - Email Geeks
2 expert opinions
Generating an a=rsa-sha256 key for DKIM primarily involves using OpenSSL to create the key. Many Email Service Providers (ESPs) direct customers to dkimcore.org for further information. The process includes using a command such as `openssl genrsa -out example.com.private 2048` to generate the private key, which should be kept secret. After generating the private key you need to extract the public key which is then used in your DNS record.
Expert view
Expert from Spam Resource (John Levine) explains that generating an RSA key for DKIM typically involves using OpenSSL with a command like `openssl genrsa -out example.com.private 2048`. This creates a private key, and you then extract the public key for your DNS record.
6 May 2022 - Spam Resource
Expert view
Expert from Email Geeks mentions that many ESPs direct customers to dkimcore.org for DKIM information and shares a link to the specification page.
17 Jun 2024 - Email Geeks
4 technical articles
Generating an a=rsa-sha256 key for DKIM involves using OpenSSL. The primary command is `openssl genrsa -out <your_domain>.private <key_length>`, where `<key_length>` is typically 1024 or 2048. This creates a private key. The corresponding public key is extracted using `openssl rsa -in <your_domain>.private -pubout -out <your_domain>.public`. The public key is then added to your DNS records. RFC 6376 specifies the use of RSA for DKIM but leaves the specific implementation details to standard practices and tools like OpenSSL.
Technical article
Documentation from dkimcore.org explains that DKIM keys can be generated using OpenSSL with commands like `openssl genrsa -out example.com.private 1024` to generate a private key and `openssl rsa -in example.com.private -pubout -out example.com.public` to extract the public key.
24 Mar 2023 - dkimcore.org
Technical article
Documentation from OpenSSL Wiki details that to generate an RSA key for DKIM using OpenSSL, you use `openssl genrsa -out dkim.private 2048` (adjust 2048 for key length).
14 Nov 2024 - OpenSSL Wiki
Are people using 4096-bit DKIM keys, and what is the recommended DKIM key length?
Can DKIM be set up on a subdomain, and which domain should be used for signing?
Do DKIM selectors affect email reputation?
Do I need multiple DKIM records if I use multiple ESPs like HubSpot, Sendgrid and ActiveCampaign?
Does the DKIM domain need to align with the List-Unsubscribe domain?
How do I find the DKIM selector for my domain in Dmarcian or Hubspot?
How do I set up DKIM on G Suite for outgoing mail, especially when using multiple email services?
How to add DKIM record for owned domain in Salesforce Marketing Cloud (SFMC)?