DKIM Key and Record Generator
Generate a DKIM key pair in your browser, or build the DNS record from a public key you already have. Nothing is sent to us: the private key is created on your device and never leaves it. If you use Google Workspace or Microsoft 365, they generate the key for you: pick your provider below and it will tell you exactly where to click instead.
The prefix for your DKIM DNS record. Common values: default, google, selector1, s1
Need a key pair? Generate one here
Only for self-hosted signing (Postfix/OpenDKIM, Exim, a custom MTA) or an ESP that asks you to supply a key. Google Workspace and Microsoft 365 generate their own and will not accept one from you.
Generated in your browser with WebCrypto. The private key is never sent to us, never logged, and is not stored anywhere. If you reload this page, it is gone.
Paste the public key from your email provider or key pair. PEM headers are removed automatically.
DNS record name
default._domainkey.yourdomain.comEnter your domain above to complete the name.
TXT record value
v=DKIM1; p=YOUR_PUBLIC_KEY_HERECommon selectors by provider
- Google Workspace: google
- Microsoft 365: selector1, selector2
- Amazon SES: varies (check SES console)
- Mailchimp: k2, k3 (k1 on older set-ups)
- SendGrid: s1, s2
Verify your DKIM is working
After publishing this record, use our DKIM Checker to confirm the key is published. The ShieldMarc dashboard shows DKIM results by sending source from your DMARC aggregate reports.
Start monitoring freeWhat is DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication method that uses cryptographic signatures to verify that an email was sent by an authorised server and has not been tampered with in transit. The sending server signs each email with a private key, and the receiving server verifies the signature using the public key published in DNS.
How DKIM records work
A DKIM record is a TXT record published at selector._domainkey.example.com. The selector allows you to have multiple DKIM keys for different sending services. When a receiving server gets an email with a DKIM signature, it looks up the selector from the signature header and retrieves the public key from DNS to verify the signature.
RSA vs Ed25519
- RSA (2048-bit): The most widely supported key type. Use 2048 bits: RFC 8301 sets 1024 bits as the minimum for RSA keys and says signers should use at least 2048. RSA public keys are long and may need to be split across multiple quoted strings in the TXT record.
- Ed25519: A newer, more compact key type with equivalent security at a fraction of the key length. Not yet supported by all receiving servers. If you use Ed25519, consider also publishing an RSA key with a different selector as a fallback.
Where to get your public key
Your email provider generates the DKIM key pair. It keeps the private key on its sending servers, and you publish the public key in DNS. This tool can build that TXT record for you.
- Google Workspace: Admin Console → Apps → Google Workspace → Gmail → Authenticate email. Google generates the key pair and gives you the TXT record value.
- Microsoft 365: Microsoft uses CNAME records (not TXT) for DKIM. Go to Security → Email & Collaboration → Policies → Email authentication settings. Microsoft publishes the public key on their servers: you only add CNAME records pointing there.
- Other providers: Most email platforms (Mailchimp, SendGrid, HubSpot, Mailgun) generate the key pair and show the records to publish in their DKIM setup wizard. Mailchimp, SendGrid and HubSpot give you CNAME records that point at a key they host, so add those to your DNS exactly as shown. Where a platform gives you a public key value instead, paste it into this tool to build the TXT record.
Frequently asked questions
What selector name should I use?
The selector can be any alphanumeric string. Most providers have a default (Google uses google, Mailchimp uses k2 and k3, SendGrid uses s1 and s2). If you are setting up DKIM manually, use something descriptive like mail or default. You can have multiple selectors: use a new one each time you rotate keys.
Can I have multiple DKIM records?
Yes. Unlike SPF, you can publish as many DKIM records as you need, each with a different selector. This is how you configure DKIM for multiple sending providers simultaneously. Each provider's emails will be signed with their own private key and verified against their corresponding selector record.
My DKIM record is too long: what do I do?
DNS TXT records have a 255-character string limit, but most DNS providers handle multi-string records automatically. If your DNS provider requires you to split the record manually, break the value into multiple quoted strings separated by a space, and receivers join them back together. Switching to Ed25519 also produces much shorter keys.
How do I verify DKIM is working?
After publishing, use our DKIM Checker to confirm the public key is published at your selector (enter the selector if it is not a common one). You can also send a test email to a Gmail address and check the headers: look for dkim=pass in the Authentication-Results header. Our Email Header Analyser will display this clearly.
How often should I rotate DKIM keys?
Best practice is to rotate DKIM keys annually or after any suspected key compromise. To rotate: generate a new key pair, publish the new public key under a new selector, update your sending provider to use the new private key, then remove the old selector record after a few days to allow in-flight messages to be verified. Our article on DKIM selector best practices covers rotation step by step.