DKIM key and record generator
Make a DKIM key in your browser and get the exact DNS record to publish, plus the settings for your mail server.
What you get
Type the domain you send mail from and a selector, and press Generate key. Your browser makes the key pair. You get the private key to save, the TXT record to publish, and ready-made settings for OpenDKIM, rspamd, Postfix and Exim. Then one link takes you to the DKIM checker to confirm the record is live.
The record comes in three forms: as one value, split into strings of at most 255 characters (the limit of one DNS string), and as a line for a BIND zone file. A bar shows how the record divides, so you can see why a 2048-bit key needs two strings.
How to set up DKIM, step by step
- Pick a selectorThe selector is a label you choose, such as
s2026-11. It lets you rotate keys later without breaking mail that is already on its way. A date works well. - Generate the keyRSA 2048 is the default and works everywhere. Choose Ed25519 plus RSA to also make a second, shorter key. Making a 4096-bit key takes a few seconds.
- Save the private keyDownload it or copy it, and keep it secret. Anyone who has it can sign mail as you. The page keeps it masked until you choose to show it.
- Publish the recordIn your DNS host, add a TXT record named
selector._domainkey(some hosts want the full name) with the value shown. Some hosts split long values for you. If yours does not, paste the pieces as shown. - Set up your mail server and checkPoint your mail server at the private key with the snippet for your software, send a test message, then run the DKIM checker. DNS can take a while to update.
Already made a key yourself? Open More options, paste the public key, and the same page formats it into a record. That works without JavaScript, because a public key is not a secret. A pasted private key is refused.
Which key to choose
| Key | Record length | TXT strings | Our advice |
|---|---|---|---|
| RSA 1024 | About 234 characters | 1 | Too weak. RFC 8301 says signers should use at least 2048 bits. Only for old systems that cannot do more. |
| RSA 2048 | About 410 characters | 2 | The default. Strong enough, and it fits in a normal DNS answer. |
| RSA 4096 | About 754 characters | 3 | Longer than most DNS hosts like, and it can go over the 512 bytes of a plain DNS answer. Rarely worth it. |
| Ed25519 | About 70 characters | 1 | Short and modern (RFC 8463), but many receivers cannot check it yet. Use it next to an RSA key, never alone. |
Signing every message twice, once with RSA and once with Ed25519, is called dual signing. Publish both records under two selectors, and sign with both. Receivers that understand Ed25519 use it, and the others fall back to RSA.
Rotating a key
Keys should be replaced now and then, and at once if one might have leaked. Make a new key under a new selector, publish it, switch your mail server to it, and keep the old record published for about a week. Mail that is still travelling can then be checked against the old key. After that, remove the old record.
DKIM is one of three checks mail receivers read. SPF lists who may send for your domain, and DMARC tells receivers what to do when the checks fail. A DKIM key on its own does not stop anyone spoofing your domain.
Without JavaScript, or on your own computer
The key maker needs JavaScript so your key can stay on your device. Without it, make the key yourself and let this page format the public half. These two commands make a 2048-bit key and print its public key as one line of base64:
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out s2026-11.private
openssl pkey -in s2026-11.private -pubout -outform der | openssl base64 -APaste that line under More options and the page returns the record, the strings and the server settings. The same formatter is available to AI assistants as the dkim_record_format tool, and in the API. It takes a public key only, and it never makes or returns a private key.
Questions people ask
Is it safe to make a DKIM key on a website?
Here it is, because the key is made by your own browser and never sent anywhere. Nothing goes to our server, to the API or to analytics, and nothing goes into the page address. Be wary of any generator that makes the key on its server, since that server then holds a copy of the secret that signs your mail.
What is a DKIM selector?
A selector is a label that tells receivers which key to look up. The record lives at selector._domainkey.yourdomain, so you can publish several keys at once and rotate them. Pick something you will recognise later, such as a date like s2026-11.
Why is my DKIM record split into two pieces?
One string in a DNS TXT record holds at most 255 characters, and a 2048-bit key makes a record of about 410. DNS joins the pieces back together, so receivers see one value. Many DNS hosts split it for you. If yours does not, paste the pieces as shown on this page.
Which key size should I use?
Use 2048 bits. A 1024-bit key is weak, and RFC 8301 says signers should use at least 2048 bits. A 4096-bit key makes a record that some DNS hosts struggle with and that can go over the size of a plain DNS answer, with little benefit for mail.
Can I use Ed25519 instead of RSA?
Not on its own. Ed25519 keys are short and modern (RFC 8463), but many receivers cannot check them yet, so mail signed only with Ed25519 can fail. Publish an RSA key too, and sign with both.
I lost the private key. Can you get it back?
No. It was made in your browser and we never had a copy. Generate a new key with a new selector, publish its record, switch your mail server to it, and remove the old record when mail signed with it has had time to arrive.
How long until the record works?
It depends on your DNS host and the old TTL, and it is usually minutes, sometimes hours. Run the DKIM checker with your domain and selector. It reads the record from DNS, so it shows what receivers will see.
Use it from AI, the API or the command line
Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is dkim_record_format. Please be kind to the rate limits.
curl "https://lookupowl.com/api/v1/tools/dkim-record-format?q=example.com&keyType=auto&publicKey=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZ1gV%2BMKHZOyvt4n%2FNrZseoVag1jHh%2BVJFUp2BXzQ8HJ5oPTLbVnw6mZ%2BawwFkHeCufF187iMp%2BvfCYqK1KxdNQlRRfg6KAwib9hVas2IiIs2yRGUulC%2BpQgDaZm795WJu9H7WLJOctg1gpgGNTfwss%2F56ie02gcT1SvG%2BZBHTFCzGMImi91otLMeZe%2B6MOn%2B2pSvw30gJCBKxdahrpTBe2ai5hGwVt8Y93mJTFjcR%2BotDc3ZtEM9IYtf%2Fr%2BdIiRFMfOrF5%2Fl7x22YazliqaFUG5jwxHMeZR%2B%2FlVW60YCKa8YgfNytY25hNqlnvx5CtRzMv%2FSoiqPVpw7D7lxeqdGwIDAQAB&selector=s2026-11&testing=false"claude mcp add --transport http lookupowl https://lookupowl.com/mcp