Why is DKIM important?

Without DKIM, anyone can send email pretending to be from your domain and recipients have no way to verify authenticity. With DKIM, plus SPF and DMARC, you have the full modern authentication stack. The major email providers — Gmail, Outlook, Yahoo — increasingly demand all three for inbox placement, which means skipping DKIM costs you deliverability, brand reputation, and effective protection against phishing campaigns that impersonate your domain.

What does the record look like?

It's a DNS TXT record published at 'selector._domainkey.yourdomain.com', with content like 'v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEB...' where the 'p=' parameter holds the public key. The selector portion is whatever name you choose — common ones are 'default', 'mail2024', or the service name. The tool produces a correctly-formatted record from your inputs.

What is a DKIM selector?

It's an identifier in the DNS path that distinguishes between different DKIM keys for the same domain. Common selectors are 'default', 'k1', 'mail', or service names like 'sendgrid' and 'mailgun'. The full path is 'selector._domainkey.yourdomain.com'. Using multiple selectors lets you rotate keys without downtime, run several mail providers simultaneously, or transition gradually between configurations — each selector has its own independent public key.

Where do I get the public key?

From your email service provider. SendGrid, Mailgun, AWS SES, Office 365, and the others generate a keypair on their side — the private key stays with them so they can sign your outgoing mail, and the public key gets handed to you to publish in DNS. Some providers can auto-publish the record if you give them DNS access (Cloudflare integration is common); others give you the key as a string and expect you to handle DNS yourself.

How do I publish DKIM record?

In your DNS provider's control panel — Cloudflare, Route 53, Google Domains, whatever you use — create a TXT record. The name is 'selector._domainkey' (or the fully-qualified version 'selector._domainkey.example.com' depending on what your provider expects). The value is the full DKIM string. TTL of 3600 is fine. Then wait 24 to 48 hours for propagation before assuming anything's broken.

How do I test DKIM is working?

The simplest check is to send yourself an email at a Gmail account, then view the original message ('Show original' in the menu) and look for 'dkim=pass' in the headers. For a more thorough check, online tools like mxtoolbox.com and dkimcore.org verify your DNS publication. Sending a test email to test@dkim.org returns an automated diagnostic report covering authentication results.

What if DKIM is failing?

The usual culprits are DNS that hasn't propagated yet (just wait), record formatting issues like extra whitespace or line breaks getting introduced when copy-pasting, a key mismatch where the public key in DNS doesn't match the private key your provider is signing with, or a selector typo somewhere. The tool can validate the format of your record, which catches the formatting issues. Most production DKIM problems trace back to DNS publishing errors rather than anything cryptographic.

DKIM Record Generator

Generate DKIM DNS TXT records for email authentication online. Free DKIM generator with RSA key pairs to prevent email spoofing.

Email Tools Web & SEO Generators

Instant results

Domain Settings

Domain Name *

DKIM Selector

Common: default, google, selector1, k1, mail

RSA Key Size

2048-bit is the industry standard. Some DNS providers have a 255-character TXT record limit, which may not fit 4096-bit keys.

How It Works

Enter your domain name and choose a selector.
Select the RSA key size (2048-bit recommended).
Click Generate to create a key pair in your browser.
Add the DNS TXT record to your domain's DNS settings.
Configure your mail server with the private key.
Test by sending an email and checking DKIM headers.

Security Notice

Keys are generated entirely in your browser using the Web Crypto API. No data is sent to any server. However, always treat your private key as a secret. Never share it publicly or commit it to version control.

Common DKIM Selectors by Provider

Provider	Selector(s)	Notes
Google Workspace	`google`	Default for Gmail / Google Workspace
Microsoft 365	`selector1 / selector2`	Auto-generated by Exchange Online
Mailchimp	`k1`	Standard for Mailchimp sending
SendGrid	`s1 / s2`	SendGrid recommended selectors
Amazon SES	`custom (e.g. ses)`	User-defined during SES setup
Postmark	`pm`	Postmark default DKIM selector
Zoho Mail	`zmail`	Default for Zoho Mail
Fastmail	`fm1 / fm2 / fm3`	Fastmail auto-generated selectors
ProtonMail	`protonmail / protonmail2`	ProtonMail custom domain selectors
Custom / Self-hosted	`default / mail`	Common conventions for self-managed servers

What is DKIM?

DKIM (DomainKeys Identified Mail) is an email authentication method that allows the receiving mail server to verify that an email was authorized by the owner of the sending domain. It works by attaching a digital signature to outgoing emails, which is linked to a cryptographic public key published in the domain's DNS records.

DKIM is one of three key email authentication protocols, alongside SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance). Together, these protocols help prevent email spoofing, phishing attacks, and improve email deliverability.

How DKIM Works

Sending Side

The domain owner generates an RSA key pair (public and private).
The public key is published as a DNS TXT record under selector._domainkey.domain.com.
The mail server uses the private key to create a cryptographic signature of the email headers and body.
This signature is added as a DKIM-Signature header to the outgoing email.

Receiving Side

The receiving mail server extracts the DKIM-Signature header.
It reads the selector and domain from the signature to look up the public key via DNS.
Using the public key, it verifies the signature against the email content.
If the signature matches, the email passes DKIM verification, confirming it was not tampered with in transit.

DKIM Record Format

A DKIM DNS record is a TXT record with the following structure:

Record Name: selector._domainkey.example.com

Record Value: v=DKIM1; k=rsa; p=MIIBIjANBgkq...

Tag Descriptions

v=DKIM1 -- Version identifier. Must be DKIM1.
k=rsa -- Key type. Currently only rsa is widely supported.
p=... -- Base64-encoded public key data. An empty p= means the key has been revoked.
t=s (optional) -- Strict mode: the "i=" domain in signatures must exactly match "d=".
t=y (optional) -- Testing mode: receiving servers should not treat DKIM failures as definitive.

The Email Authentication Trio: SPF, DKIM, and DMARC

For maximum email security and deliverability, it is recommended to implement all three email authentication protocols together:

SPF (Sender Policy Framework): Specifies which mail servers are authorized to send email on behalf of your domain. Defined as a DNS TXT record on your root domain.
DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to outgoing emails, allowing receivers to verify the message was not altered and was authorized by the domain owner.
DMARC (Domain-based Message Authentication, Reporting, and Conformance): Tells receiving servers what to do when SPF or DKIM checks fail (none, quarantine, or reject), and provides a reporting mechanism.

How to Use DKIM Record Generator

Get public key from email service

Find the DKIM public key in your email provider's dashboard — it's usually under email authentication settings or sender domain verification. SendGrid, Mailgun, AWS SES, Postmark, Office 365, and the others all surface this in slightly different places, but the key itself is just a long string of base64-encoded characters that you'll paste into the tool.

Choose a selector

Pick a name for this DKIM key — the selector becomes part of the DNS path. 'default' is fine for a single-provider setup; for multi-provider deployments use the service name ('sendgrid', 'mailgun') so you can identify each key at a glance. You can use multiple selectors on the same domain, which is how key rotation and multi-service setups work.

Generate DNS record

The tool produces a properly-formatted DNS TXT record — name 'selector._domainkey.yourdomain' with value 'v=DKIM1; k=rsa; p=publickey'. Copy the full record exactly. Watch for whitespace and line breaks getting introduced during copy-paste, since those break the record without producing an obvious error.

Publish and verify

Add the TXT record in your DNS provider's control panel (Cloudflare, Route 53, whatever you use). Wait 24 to 48 hours for DNS propagation to complete. Verify by running the domain through mxtoolbox.com, or by sending yourself a test email and checking the headers for 'dkim=pass' on the receiving side. If verification fails after propagation, double-check the record value matches what the generator produced exactly.

When to Use DKIM Record Generator

Email authentication setup

DKIM (DomainKeys Identified Mail) is one of the three pillars of modern email authentication, alongside SPF and DMARC. Your sending server signs outgoing email with a private key, and recipients verify the signature against a public key you publish in DNS. Without it, your messages are far more likely to land in the spam folder or get rejected outright by Gmail and Outlook, which have steadily tightened their authentication requirements.

New email service setup

Every transactional email provider — SendGrid, Mailgun, AWS SES, Postmark, and the others — requires you to publish a DKIM record before they'll send mail on your behalf. The tool helps you format the record correctly given the public key the provider supplies, which is faster than digging through their per-provider documentation and makes mistakes less likely on the DNS side.

Domain authentication audit

For an existing DKIM setup, the tool can decode your published records, validate that the format is correct, and surface any issues that might be hurting deliverability. This matters during security audits, when troubleshooting bounce-back patterns, and when you suspect a key may have been exposed and need to be rotated quickly.

Multi-provider setup

Larger organizations often use multiple email providers — one for transactional mail, another for marketing campaigns, a third for support replies. Each provider needs its own DKIM record under a different selector, and the tool helps you manage that fleet of records without losing track. Especially helpful for enterprise teams and agencies running DKIM for client domains.

DKIM Record Generator Examples

Standard DKIM TXT record

Input

Selector: default, Domain: example.com, Public key: provided by mail service

Output

default._domainkey.example.com TXT v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDx...

A standard DKIM record. The selector ('default' here) is something you pick — it's used in the DNS path so receivers know which key to fetch. The 'p=' parameter holds the public key, which your mail service supplies. You publish the record at 'default._domainkey.yourdomain.com' as a TXT record in DNS.

Multiple selectors

Input

Selectors: mailgun, sendgrid

Output

mailgun._domainkey.example.com TXT v=DKIM1...\nsendgrid._domainkey.example.com TXT v=DKIM1...

When you use multiple email providers, each gets its own selector and its own DKIM record. Both records coexist in DNS without conflict, so Mailgun can sign your marketing mail while SendGrid signs transactional, and recipients verify each with the correct public key. The pattern scales to as many providers as you need.

Decoding existing record

Input

Existing: v=DKIM1; k=rsa; p=ABC123...

Output

Type: DKIM version 1. Algorithm: RSA. Public key parses cleanly. Record format is correct.

Validating an existing record is useful when you've just published it and want to confirm DNS propagation worked, when you're troubleshooting authentication failures showing up in DMARC reports, or when you're auditing the DKIM setup of a domain you've inherited. The tool parses the record and tells you whether the structure is valid.

Tips & Best Practices for DKIM Record Generator

1.DKIM only does its full job when paired with SPF and DMARC. All three together form the modern email authentication trio, and skipping any of them noticeably reduces deliverability with the major providers. Set up SPF first, add DKIM, then layer DMARC on top.
2.Pick selector names that mean something. 'default' works for a single setup, but for multi-provider deployments use the service name ('sendgrid', 'mailgun', 'postmark') so you can tell at a glance which DNS record belongs to which provider. The selector becomes part of the DNS path, so naming it well pays off during troubleshooting.
3.Use 2048-bit RSA keys for new setups. 1024-bit keys are considered legacy and increasingly weak — Google and others have publicly noted they're acceptable but not preferred. There's no real downside to 2048-bit; it's just the modern default.
4.Verify after DNS propagation finishes. Tools like mxtoolbox.com confirm your DKIM record is published correctly and parses without errors. DNS changes typically need 24 to 48 hours to propagate fully, so don't panic if verification fails immediately after you push the record.
5.Rotate keys periodically. A compromised private key means an attacker can forge signatures from your domain, which is bad. Annual rotation is a reasonable default, with an immediate rotation if you have any reason to suspect the key has leaked. Most providers make this straightforward through their dashboard.
6.Account for every service that sends from your domain. A forgotten transactional service that doesn't have DKIM configured will see its mail flagged as unauthenticated, which is exactly the kind of subtle deliverability problem that takes months to track down. Audit your sending services periodically.

Frequently Asked Questions

DomainKeys Identified Mail is a cryptographic email authentication protocol. Your sending mail server signs outgoing messages with a private key, and the receiving server verifies the signature using a public key you publish in DNS. The verification proves two things: that the email genuinely came from your domain (anti-spoofing) and that the content wasn't tampered with along the way (anti-tampering). It's been a standard since 2007.

DKIM Record Generator

Domain Settings

How It Works

Security Notice

Common DKIM Selectors by Provider

What is DKIM?

How DKIM Works

Sending Side

Receiving Side

DKIM Record Format

Tag Descriptions

The Email Authentication Trio: SPF, DKIM, and DMARC

How to Use DKIM Record Generator

Get public key from email service

Choose a selector

Generate DNS record

Publish and verify

When to Use DKIM Record Generator

Email authentication setup

New email service setup

Domain authentication audit

Multi-provider setup

DKIM Record Generator Examples

Standard DKIM TXT record

Multiple selectors

Decoding existing record

Tips & Best Practices for DKIM Record Generator

Frequently Asked Questions

Related Tools

DMARC Record Generator

SPF Record Generator

Email Header Analyzer

Email Spam Checker

MX Record Lookup

Email Subject Line Tester