DKIM Record Generator
Generate DKIM DNS TXT records from a pasted public key with selector and domain validation, automatic 255-character chunk splitting for DNS providers, hash
Loading tool...
What is DKIM Record Generator?
The DKIM Record Generator turns a pasted public key into a publish-ready DKIM DNS TXT record. Fill in the selector and domain, paste your key, choose key type and options, and copy either the single-line record or the pre-split version for DNS panels that enforce the 255-character limit per TXT string.
Key Benefits
- Correct v=DKIM1 syntax with k=, h=, t=, and p= tags composed for you
- Automatic 255-character chunk splitting prevents silently broken records in strict DNS panels
- Base64 validation catches truncated or malformed keys before they reach production
- Testing-mode (t=y) support lets you roll out DKIM without delivery risk
- Zero uploads - keys stay in your browser the whole time
Common Use Cases
- •Setting up email deliverability for a new sending domain alongside SPF and DMARC
- •Rotating DKIM keys by publishing a new selector before switching signers
- •Debugging why Gmail or Outlook flags your mail as unauthenticated
- •Preparing DNS change tickets with exact record values for ops teams
Publish a DKIM DNS Record
- Enter selector and domain: Type the selector your mail server signs with (default is common) and your domain — the publish target shows as selector._domainkey.domain, e.g. default._domainkey.example.com.
- Paste your public key: Choose rsa or ed25519 as the key type (k=), then paste the base64 public key — PEM headers and whitespace are stripped automatically, and invalid base64 is flagged.
- Set options: Restrict h= to sha256 or allow both hashes, and optionally enable testing mode (t=y) while you confirm that receivers validate your signatures without rejecting mail.
- Copy and publish: Copy the single-line record, or the 255-character split version if your DNS provider requires quoted chunks, then add it as a TXT record at the shown name — everything is generated locally in your browser.
Key Features
- Generates the exact v=DKIM1 record from a pasted public key in raw base64 or PEM format.
- Automatic 255-character splitting into quoted TXT strings for Cloudflare, Route 53, GoDaddy, and more.
- Key type selection (rsa or ed25519) plus optional h= hash restriction with sha256 and sha1.
- Base64 validation catches paste errors; t=y testing mode warns you before enforcement goes live.
- Shows the exact publish location selector._domainkey.yourdomain.com with record length tracking.
- Runs entirely in your browser - your keys never leave your machine.
Frequently Asked Questions
What do I put in the public key field?
The base64 public key (the p= value) from the key pair your mail server signs with, for example from openssl rsa -in private.key -pubout -outform DER | base64. PEM armor and whitespace are stripped automatically, and non-base64 input is rejected.
Where do I publish the generated record?
As a DNS TXT record at selector._domainkey.domain — the tool shows the exact name, e.g. default._domainkey.example.com. Make sure the selector matches the one your mail server actually signs with.
Why is the record split into quoted chunks?
Many DNS providers limit each TXT string to 255 characters. The tool offers a 255-character split output for pasting as multiple quoted strings, and warns when a 2048-bit RSA key pushes the record past the limit.
RSA or Ed25519, and should I enable testing mode?
Use k=rsa with at least 2048-bit keys for maximum compatibility; ed25519 produces a much shorter record but fewer receivers support it. Testing mode adds t=y so receivers report failures without rejecting mail — remove it once verification is confirmed. Nothing you paste leaves your browser.