DKIM record generator
Generating DKIM key pair...
Generate DKIM keys without exposing secret material
DKIM key builder
Create a fresh DKIM DNS record and matching secret key with best practice defaults, then copy the exact public key value into DNS and keep the secret key in your sending service. After publishing, use the DKIM checker to verify live DNS before changing working mail authentication.
Get started
DKIM generation that starts secure
Use the DKIM record generator to create a compatible 2048 bit RSA key pair, choose the selector your sender will sign with, regenerate keys on demand, and avoid publishing secret key material by mistake.
RSA
SHA-256
2048-bit
Generated key pair
Create a matching public DNS record and secret signing key for your selector.
DKIM record
google._domainkey.example.com
TXTv=DKIM1; k=rsa; p=MIGf...
Copyable DNS record
Publish one DKIM TXT value containing the public key for your selector.
Testing mode off
t=y absent
Secret key warning
Keep the secret key separate from DNS and only install it in your signer.
Record found
Single record
Record valid
Record checks
Review generated DNS syntax before copying the selector record into DNS.
google
selector1
mail
Selector planning
Use a new selector name so you can publish the next key before retiring the old one.
DNS provider
Selector managed in DNS
DNS publishing context
Copy the public key into the selector TXT record while keeping private key material out of DNS.
DKIM record generator FAQs
Answers to common questions about generating, publishing, and rotating DKIM keys.
No. It generates values you can copy. You still publish the public DNS record in your DNS provider and configure the secret key in your mail service.
Use 2048 bit RSA for most domains. It is widely supported and strong enough for modern DKIM. Use 4096 only if your DNS provider and mail service support long TXT records.
Publish it as a TXT record at selector._domainkey.yourdomain.com, replacing selector with the selector configured in your sending service. The DNS value should contain the public key, usually in the p= tag, not the secret key.
DKIM2 is work on improving how signed email can be authenticated in the future. It is not the same thing as the DKIM TXT record you are usually asked to publish when setting up a sending platform. Read DKIM2 explained.
No, not from a blog post or draft alone. Change DKIM records when your sending provider gives you a supported setup path. Until then, keep validating the selector record your sender actually uses today. See whether to change DKIM records for DKIM2.
It becomes actionable when a sender or mailbox provider you rely on documents support and gives exact setup steps. Until then, the useful work is still normal DKIM: strong keys, clean selectors, valid DNS, and DMARC alignment. Learn when DKIM2 needs setup.
The secret key goes only into the system that signs outgoing mail. Do not publish it in DNS, send it in tickets, or store it anywhere public.
Use RSA unless your sender explicitly supports Ed25519 DKIM. Ed25519 is compact and secure, but DKIM receiver and provider support is less universal.
Rotate DKIM keys when a secret key may be exposed, when changing senders, or on a regular security schedule. Publish the new selector first, switch signing, then remove the old selector after old mail has aged out.
How MONEYME proactively strengthens domain security and unlocks higher email engagement with Suped
See how MONEYME uses Suped
How cybersecurity specialist Jam Cyber delivers scalable DMARC protection with Suped
See how Jam Cyber uses Suped
How Vision Australia maintains full DMARC enforcement across a large domain portfolio with Suped
See how Vision Australia uses Suped
How The POP Team turns domain checks and DMARC visibility into client ready delivery work
See how The POP Team uses Suped
How DigiBean simplified DMARC monitoring and improved email security for their MSP clients
See how DigiBean uses Suped
How Alliance Group moved from reactive guesswork to proactive email management with Suped
See how Alliance Group uses Suped
Start monitoring your DMARC reports today
What you'll get with Suped
Real-time DMARC report monitoring and analysis
Automated alerts for authentication failures
Clear recommendations to improve email deliverability
Protection against phishing and domain spoofing