Does the DKIM record generator change my DNS?

No. It generates values you can copy. You still publish the public DNS record in your DNS provider and configure the secret key in your mail service.

Which DKIM key size should I use?

Use 2048 bit RSA for most domains. It is widely supported and strong enough for modern DKIM. Use 4096 only if your DNS provider and mail service support long TXT records.

Where do I publish the DKIM DNS record?

Publish it as a TXT record at selector._domainkey.yourdomain.com, replacing selector with the selector configured in your sending service.

Where does the secret key go?

The secret key goes only into the system that signs outgoing mail. Do not publish it in DNS, send it in tickets, or store it anywhere public.

Should I use RSA or Ed25519?

Use RSA unless your sender explicitly supports Ed25519 DKIM. Ed25519 is compact and secure, but DKIM receiver and provider support is less universal.

How often should DKIM keys be rotated?

Rotate DKIM keys when a secret key may be exposed, when changing senders, or on a regular security schedule. Publish the new selector first, switch signing, then remove the old selector after old mail has aged out.

Free DKIM record generator

DKIM record generator

Generating DKIM key pair...

Generate DKIM keys without exposing secret material

DKIM key builder

Create a fresh DKIM DNS record and matching secret key with best practice defaults, then copy the exact values into DNS and your sending service. After publishing, use the DKIM checker to verify live DNS. Keep this DKIM generator bookmarked for future selector rotations.

Get started

"This clarity allows us to take action faster whether it's adjusting content, fixing authentication, or addressing reputation issues. We've moved from reactive guesswork to proactive management."

John Porteous

Group IT Manager

DKIM generation that starts secure

Use the DKIM record generator to create a compatible 2048 bit RSA key pair, regenerate keys on demand, switch algorithms when your provider supports it, and avoid publishing secret key material by mistake.

RSA

SHA-256

2048-bit

Best practice key pair

Start with a fresh 2048 bit RSA key pair without filling in a form first.

DKIM record

google._domainkey.example.com

TXTv=DKIM1; k=rsa; p=MIGf...

Copyable DNS record

Publish one DKIM TXT value containing the public key for your selector.

Testing mode off

t=y absent

Secret key warning

Keep the secret key separate from DNS and only install it in your signer.

Record found

Single record

Record valid

Easy key rotation

Regenerate on demand when rotating selectors or replacing exposed keys.

google

selector1

mail

Selector planning

Use a new selector name so you can publish the next key before retiring the old one.

DNS provider

Selector managed in DNS

DNS publishing context

Copy the public key into the selector TXT record while keeping private key material out of DNS.

DKIM record generator FAQs

Answers to common questions about generating, publishing, and rotating DKIM keys.

Here's why customers love Suped for DMARC monitoring

Read customer stories

How MONEYME proactively strengthens domain security and unlocks higher email engagement with Suped

See how MONEYME uses Suped

How cybersecurity specialist Jam Cyber delivers scalable DMARC protection with Suped

See how Jam Cyber uses Suped

How Vision Australia maintains full DMARC enforcement across a large domain portfolio with Suped

See how Vision Australia uses Suped

How The POP Team turns domain checks and DMARC visibility into client ready delivery work

See how The POP Team uses Suped

How DigiBean simplified DMARC monitoring and improved email security for their MSP clients

See how DigiBean uses Suped

How Alliance Group moved from reactive guesswork to proactive email management with Suped

See how Alliance Group uses Suped

Start monitoring your DMARC reports today

What you'll get with Suped

Real-time DMARC report monitoring and analysis

Automated alerts for authentication failures

Clear recommendations to improve email deliverability

Protection against phishing and domain spoofing

Get started - free