# DKIM Generator: Make a Key and the DNS Record

Format a DKIM DNS record from a PUBLIC key (PEM, bare base64 or an existing record): the record name (selector._domainkey.domain), the TXT value, the value split into 255-byte strings, a BIND zone-file line, snippets for OpenDKIM, rspamd, Postfix and Exim, and warnings for keys under 2048 bits, keys too large for one DNS answer and Ed25519 used alone. This tool never generates a key and refuses a private key: keys are made in the browser on the web page, and a private key never leaves it. With no public key it returns the record name, the snippets and the openssl commands that make a key on your own computer. Link to dkim_check once the record is published.

**Not for:** Generating keys (the web page does that in your browser) or checking a published record (use dkim_check).

- Tool id: `dkim-record-format`
- Category: email
- Execution: pure
- MCP tool `dkim_record_format` at https://lookupowl.com/mcp
- REST `GET https://lookupowl.com/api/v1/tools/dkim-record-format` (or POST a JSON body)
- OpenAPI: https://lookupowl.com/api/openapi.json

## Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `domain` | string | yes |  | The domain you send mail from, such as example.com. min length 1, max length 253 |
| `selector` | string | yes |  | A label you choose, for example s2026-11. It lets you rotate keys without breaking old mail. Letters, digits, hyphens, underscores and dots. min length 1, max length 63 |
| `publicKey` | string | no | `""` | The PUBLIC key as PEM (-----BEGIN PUBLIC KEY-----), bare base64, or an existing DKIM record to re-format. Never a private key: a private key is refused. Leave it empty to get only the record name, the server snippets and the openssl commands. max length 8192 |
| `keyType` | "auto" \| "rsa" \| "ed25519" | no | `"auto"` | The key type of the public key (k= in the record). auto reads it from the key. Set it only to make the tool check that the key is what you think it is. |
| `testing` | boolean | no | `false` | Mark the record as testing (t=y), so receivers do not treat failures as errors. |

## Output

Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields:

| Field | Type | Description |
|---|---|---|
| `selector` | string |  |
| `domain` | string |  |
| `recordName` | string | selector._domainkey.domain |
| `host` | string | The name without the domain (selector._domainkey), for DNS hosts that add the domain themselves. |
| `ttl` | integer | A suggested TTL in seconds. min -9007199254740991, max 9007199254740991 |
| `keys` | object[] | One entry for the key given. Empty when no public key was given. max 2 items |
| `snippets` | object |  |
| `openssl` | string[] | Commands that make a 2048-bit key on your own computer and print its public key, for this selector. |
| `warnings` | object[] |  |
| `checkUrl` | string | /dkim-checker?q=domain&selector=... (only the domain and the selector, never a key). |

## Examples

### A 2048-bit RSA public key

```json
{"domain":"example.com","selector":"s2026-11","publicKey":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZ1gV+MKHZOyvt4n/NrZseoVag1jHh+VJFUp2BXzQ8HJ5oPTLbVnw6mZ+awwFkHeCufF187iMp+vfCYqK1KxdNQlRRfg6KAwib9hVas2IiIs2yRGUulC+pQgDaZm795WJu9H7WLJOctg1gpgGNTfwss/56ie02gcT1SvG+ZBHTFCzGMImi91otLMeZe+6MOn+2pSvw30gJCBKxdahrpTBe2ai5hGwVt8Y93mJTFjcR+otDc3ZtEM9IYtf/r+dIiRFMfOrF5/l7x22YazliqaFUG5jwxHMeZR+/lVW60YCKa8YgfNytY25hNqlnvx5CtRzMv/SoiqPVpw7D7lxeqdGwIDAQAB","keyType":"auto","testing":false}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/dkim-record-format?domain=example.com&keyType=auto&publicKey=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZ1gV%2BMKHZOyvt4n%2FNrZseoVag1jHh%2BVJFUp2BXzQ8HJ5oPTLbVnw6mZ%2BawwFkHeCufF187iMp%2BvfCYqK1KxdNQlRRfg6KAwib9hVas2IiIs2yRGUulC%2BpQgDaZm795WJu9H7WLJOctg1gpgGNTfwss%2F56ie02gcT1SvG%2BZBHTFCzGMImi91otLMeZe%2B6MOn%2B2pSvw30gJCBKxdahrpTBe2ai5hGwVt8Y93mJTFjcR%2BotDc3ZtEM9IYtf%2Fr%2BdIiRFMfOrF5%2Fl7x22YazliqaFUG5jwxHMeZR%2B%2FlVW60YCKa8YgfNytY25hNqlnvx5CtRzMv%2FSoiqPVpw7D7lxeqdGwIDAQAB&selector=s2026-11&testing=false'
```

Web page: https://lookupowl.com/dkim-generator?q=example.com&keyType=auto&publicKey=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZ1gV%2BMKHZOyvt4n%2FNrZseoVag1jHh%2BVJFUp2BXzQ8HJ5oPTLbVnw6mZ%2BawwFkHeCufF187iMp%2BvfCYqK1KxdNQlRRfg6KAwib9hVas2IiIs2yRGUulC%2BpQgDaZm795WJu9H7WLJOctg1gpgGNTfwss%2F56ie02gcT1SvG%2BZBHTFCzGMImi91otLMeZe%2B6MOn%2B2pSvw30gJCBKxdahrpTBe2ai5hGwVt8Y93mJTFjcR%2BotDc3ZtEM9IYtf%2Fr%2BdIiRFMfOrF5%2Fl7x22YazliqaFUG5jwxHMeZR%2B%2FlVW60YCKa8YgfNytY25hNqlnvx5CtRzMv%2FSoiqPVpw7D7lxeqdGwIDAQAB&selector=s2026-11&testing=false

### The same key marked as testing

```json
{"domain":"example.com","selector":"mail2026","publicKey":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZ1gV+MKHZOyvt4n/NrZseoVag1jHh+VJFUp2BXzQ8HJ5oPTLbVnw6mZ+awwFkHeCufF187iMp+vfCYqK1KxdNQlRRfg6KAwib9hVas2IiIs2yRGUulC+pQgDaZm795WJu9H7WLJOctg1gpgGNTfwss/56ie02gcT1SvG+ZBHTFCzGMImi91otLMeZe+6MOn+2pSvw30gJCBKxdahrpTBe2ai5hGwVt8Y93mJTFjcR+otDc3ZtEM9IYtf/r+dIiRFMfOrF5/l7x22YazliqaFUG5jwxHMeZR+/lVW60YCKa8YgfNytY25hNqlnvx5CtRzMv/SoiqPVpw7D7lxeqdGwIDAQAB","keyType":"auto","testing":true}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/dkim-record-format?domain=example.com&keyType=auto&publicKey=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZ1gV%2BMKHZOyvt4n%2FNrZseoVag1jHh%2BVJFUp2BXzQ8HJ5oPTLbVnw6mZ%2BawwFkHeCufF187iMp%2BvfCYqK1KxdNQlRRfg6KAwib9hVas2IiIs2yRGUulC%2BpQgDaZm795WJu9H7WLJOctg1gpgGNTfwss%2F56ie02gcT1SvG%2BZBHTFCzGMImi91otLMeZe%2B6MOn%2B2pSvw30gJCBKxdahrpTBe2ai5hGwVt8Y93mJTFjcR%2BotDc3ZtEM9IYtf%2Fr%2BdIiRFMfOrF5%2Fl7x22YazliqaFUG5jwxHMeZR%2B%2FlVW60YCKa8YgfNytY25hNqlnvx5CtRzMv%2FSoiqPVpw7D7lxeqdGwIDAQAB&selector=mail2026&testing=true'
```

Web page: https://lookupowl.com/dkim-generator?q=example.com&keyType=auto&publicKey=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZ1gV%2BMKHZOyvt4n%2FNrZseoVag1jHh%2BVJFUp2BXzQ8HJ5oPTLbVnw6mZ%2BawwFkHeCufF187iMp%2BvfCYqK1KxdNQlRRfg6KAwib9hVas2IiIs2yRGUulC%2BpQgDaZm795WJu9H7WLJOctg1gpgGNTfwss%2F56ie02gcT1SvG%2BZBHTFCzGMImi91otLMeZe%2B6MOn%2B2pSvw30gJCBKxdahrpTBe2ai5hGwVt8Y93mJTFjcR%2BotDc3ZtEM9IYtf%2Fr%2BdIiRFMfOrF5%2Fl7x22YazliqaFUG5jwxHMeZR%2B%2FlVW60YCKa8YgfNytY25hNqlnvx5CtRzMv%2FSoiqPVpw7D7lxeqdGwIDAQAB&selector=mail2026&testing=true

### An Ed25519 public key

```json
{"domain":"example.com","selector":"s2026-11e","publicKey":"4ZUzU2yxkUmNeZPghwPEhjwxFlQjBQGMNiwOKFkdMGo=","keyType":"ed25519","testing":false}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/dkim-record-format?domain=example.com&keyType=ed25519&publicKey=4ZUzU2yxkUmNeZPghwPEhjwxFlQjBQGMNiwOKFkdMGo%3D&selector=s2026-11e&testing=false'
```

Web page: https://lookupowl.com/dkim-generator?q=example.com&keyType=ed25519&publicKey=4ZUzU2yxkUmNeZPghwPEhjwxFlQjBQGMNiwOKFkdMGo%3D&selector=s2026-11e&testing=false

## Web pages

- https://lookupowl.com/dkim-generator

## Limits and caching

- Cost: 1 unit for a live lookup, 1 unit for a cached one. Budgets are per network and published in the `RateLimit` response headers.
- Cache: results are kept for 86400 s.
- Timeout: 5 s.

## Related tools

- [DKIM Record Checker](https://lookupowl.com/tools/dkim-checker.md): Find and check a domain's DKIM public keys, even when you do not know the selector.
- [DMARC Record Generator](https://lookupowl.com/tools/dmarc-generator.md): Build a valid DMARC record, with report authorization records and a step-by-step rollout plan.
- [SPF Record Generator](https://lookupowl.com/tools/spf-generator.md): Build a valid SPF record from your mail providers and IP addresses, with a lookup-limit check.
- [DMARC Record Checker](https://lookupowl.com/tools/dmarc-checker.md): Look up and validate a domain's DMARC policy, report addresses and alignment settings.
- [IP and Domain Blacklist Checker](https://lookupowl.com/tools/blacklist-checker.md): Check an IP address, a mail server or a domain against live spam blocklists, with how to get delisted.

## Guide: DKIM key and record generator

Make a DKIM key in your browser and get the exact DNS record to publish, plus the settings for your mail server.

### What you get

Type the domain you send mail from and a selector, and press Generate key. Your browser makes the key pair. You get the private key to save, the TXT record to publish, and ready-made settings for OpenDKIM, rspamd, Postfix and Exim. Then one link takes you to the [DKIM checker](https://lookupowl.com/dkim-checker) to confirm the record is live.

The record comes in three forms: as one value, split into strings of at most 255 characters (the limit of one DNS string), and as a line for a BIND zone file. A bar shows how the record divides, so you can see why a 2048-bit key needs two strings.

> **Your private key stays on your device** The key is made by your browser (WebCrypto). It is not sent to us, not stored, not passed to analytics and not put in the page address. That also means we cannot get it back for you. Save it before you leave the page.

### How to set up DKIM, step by step

1. **Pick a selector**: The selector is a label you choose, such as `s2026-11`. It lets you rotate keys later without breaking mail that is already on its way. A date works well.
2. **Generate the key**: RSA 2048 is the default and works everywhere. Choose Ed25519 plus RSA to also make a second, shorter key. Making a 4096-bit key takes a few seconds.
3. **Save the private key**: Download it or copy it, and keep it secret. Anyone who has it can sign mail as you. The page keeps it masked until you choose to show it.
4. **Publish the record**: In your DNS host, add a TXT record named `selector._domainkey` (some hosts want the full name) with the value shown. Some hosts split long values for you. If yours does not, paste the pieces as shown.
5. **Set up your mail server and check**: Point your mail server at the private key with the snippet for your software, send a test message, then run the [DKIM checker](https://lookupowl.com/dkim-checker). DNS can take a while to update.

Already made a key yourself? Open More options, paste the public key, and the same page formats it into a record. That works without JavaScript, because a public key is not a secret. A pasted private key is refused.

### Which key to choose

| Key | Record length | TXT strings | Our advice |
|---|---|---|---|
| RSA 1024 | About 234 characters | 1 | Too weak. RFC 8301 says signers should use at least 2048 bits. Only for old systems that cannot do more. |
| RSA 2048 | About 410 characters | 2 | The default. Strong enough, and it fits in a normal DNS answer. |
| RSA 4096 | About 754 characters | 3 | Longer than most DNS hosts like, and it can go over the 512 bytes of a plain DNS answer. Rarely worth it. |
| Ed25519 | About 70 characters | 1 | Short and modern (RFC 8463), but many receivers cannot check it yet. Use it next to an RSA key, never alone. |

Signing every message twice, once with RSA and once with Ed25519, is called dual signing. Publish both records under two selectors, and sign with both. Receivers that understand Ed25519 use it, and the others fall back to RSA.

### Rotating a key

Keys should be replaced now and then, and at once if one might have leaked. Make a new key under a new selector, publish it, switch your mail server to it, and keep the old record published for about a week. Mail that is still travelling can then be checked against the old key. After that, remove the old record.

DKIM is one of three checks mail receivers read. [SPF](https://lookupowl.com/spf-record-generator) lists who may send for your domain, and [DMARC](https://lookupowl.com/dmarc-record-generator) tells receivers what to do when the checks fail. A DKIM key on its own does not stop anyone spoofing your domain.

### Without JavaScript, or on your own computer

The key maker needs JavaScript so your key can stay on your device. Without it, make the key yourself and let this page format the public half. These two commands make a 2048-bit key and print its public key as one line of base64:

```bash
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out s2026-11.private
openssl pkey -in s2026-11.private -pubout -outform der | openssl base64 -A
```

Paste that line under More options and the page returns the record, the strings and the server settings. The same formatter is available to AI assistants as the `dkim_record_format` tool, and in the API. It takes a public key only, and it never makes or returns a private key.

### Frequently asked questions

**Is it safe to make a DKIM key on a website?**

Here it is, because the key is made by your own browser and never sent anywhere. Nothing goes to our server, to the API or to analytics, and nothing goes into the page address. Be wary of any generator that makes the key on its server, since that server then holds a copy of the secret that signs your mail.

**What is a DKIM selector?**

A selector is a label that tells receivers which key to look up. The record lives at selector._domainkey.yourdomain, so you can publish several keys at once and rotate them. Pick something you will recognise later, such as a date like s2026-11.

**Why is my DKIM record split into two pieces?**

One string in a DNS TXT record holds at most 255 characters, and a 2048-bit key makes a record of about 410. DNS joins the pieces back together, so receivers see one value. Many DNS hosts split it for you. If yours does not, paste the pieces as shown on this page.

**Which key size should I use?**

Use 2048 bits. A 1024-bit key is weak, and RFC 8301 says signers should use at least 2048 bits. A 4096-bit key makes a record that some DNS hosts struggle with and that can go over the size of a plain DNS answer, with little benefit for mail.

**Can I use Ed25519 instead of RSA?**

Not on its own. Ed25519 keys are short and modern (RFC 8463), but many receivers cannot check them yet, so mail signed only with Ed25519 can fail. Publish an RSA key too, and sign with both.

**I lost the private key. Can you get it back?**

No. It was made in your browser and we never had a copy. Generate a new key with a new selector, publish its record, switch your mail server to it, and remove the old record when mail signed with it has had time to arrive.

**How long until the record works?**

It depends on your DNS host and the old TTL, and it is usually minutes, sometimes hours. Run the [DKIM checker](https://lookupowl.com/dkim-checker) with your domain and selector. It reads the record from DNS, so it shows what receivers will see.