DKIM record generator

Usually not. Most email providers generate the key pair themselves, keep the private half, and give you records to publish. Amazon SES Easy DKIM, for example, asks for three CNAME records that point at keys Amazon SES hosts, and signs with a 2048-bit key by default. If your provider gives you records, publish those and you are done: nothing on this page improves on them.

You need your own key when you sign mail yourself, on your own mail server or with a signing library, or when a provider asks you to bring one. Amazon SES offers that too, as Bring Your Own DKIM: you publish a single TXT record and give SES the private key, which it accepts at 1024 to 2048 bits.

RFC 8301 sets the rules. Signers must use RSA keys of at least 1024 bits and should use 2048, and every verifier must accept keys from 1024 to 4096 bits. It also retires rsa-sha1: signatures use rsa-sha256, which is what these keys are for.

So 2048 is the default here and the right choice for nearly everyone. 1024 is the floor, worth choosing only for a DNS host or signer that cannot take a longer value; Amazon SES keeps a 1024-bit option for exactly that case, a DNS provider that only supports 1024-bit DKIM. 4096 verifies everywhere but doubles the record length, and some signers stop at 2048, Amazon SES's Bring Your Own DKIM among them.

The selector is the name the key is published under, and every signature carries it in its s= tag so receivers know which record to fetch. Any short DNS label works. A name that says when the key was made, such as 2026-10, makes the next rotation obvious, and each service that signs for your domain should have a selector of its own.

To rotate, publish the new key under a new selector, then switch your signer to it. Leave the old record in place for at least a week: RFC 5321 expects mail servers to keep retrying undelivered mail for at least four to five days, and a message signed with the old key can arrive that late. Then revoke the old key by publishing its record with an empty p= value, which RFC 6376 defines as a revoked key. Rotate on a schedule you will keep, and at once if a private key may have leaked.

A 2048-bit key makes a record of about 410 characters, and one string in a TXT record holds at most 255. How you enter a long value depends on your DNS host. Amazon Route 53, for one, expects it as several quoted strings on one line, which is the second form this tool gives you; a host that takes the value in one piece gets the first.

Receivers join the strings with nothing in between, as RFC 6376 requires, so both forms publish exactly the same record, and the cut can fall anywhere, even in the middle of the key. A 1024-bit record fits in one string; a 4096-bit record needs three.

The key pair is generated by your browser's Web Crypto API, on your own device. The private key is never sent anywhere: no request, log or analytics event carries it, and closing the tab discards it. Once the page has loaded, the generator works without a connection at all.

That is also why it cannot be recovered. Copy it or download it, and put it in your signing server or provider before you leave. It never goes in DNS: only the public half does, inside the record above.