Our free DKIM DNS record generator that builds the v=DKIM1 TXT record and the exact selector._domainkey hostname to publish it at. Paste the public key your provider gave you and our DKIM generator writes the rest — a free DKIM DNS record generator with no signup.
Common values: mail, google, s1, default. Use the selector your mail provider specifies.
DKIM signs outgoing mail with a private key and publishes the matching public key in DNS. This free DKIM DNS record generator turns that public half into the exact TXT record receivers expect, at the exact DKIM hostname they will query.
A DKIM record lives at selector._domainkey.yourdomain rather than at the domain root, and a DKIM generator writes the full hostname so you do not have to guess it. Publishing a correct DKIM record at the wrong host is the most common DKIM failure there is.
v=DKIM1; k=rsa; p=<public key>. The version tag must come first, the key type is almost always RSA, and the p tag carries the base64 public key. Our free DKIM record generator only ever handles the public half — any DKIM generator asking for your private key is doing something you should refuse.
2048-bit DKIM keys are the modern default. 1024-bit exists only because some legacy DNS providers truncate long TXT values, and a truncated DKIM record validates as broken rather than as missing. This DKIM record generator emits the full record and leaves the panel problem visible.
Every provider generates the DKIM key pair for you and shows the public half. Paste it into this DKIM generator with the DKIM selector they specify, and a DKIM generator writes the record.
Run our free DKIM record generator once per sending provider. Every provider that sends as your domain needs its own DKIM selector and its own DKIM record — there is no single combined DKIM record, and merging two DKIM record generator outputs breaks both. Rotate DKIM keys when a provider offers it, and delete the DKIM record for any provider you stop using.
DKIM alone does not protect the visible From header. To complete your email authentication setup, add a DMARC policy that aligns DKIM results with the From domain. A clean email list also matters — even authenticated mail lands in spam if it bounces repeatedly. Use email verification to remove invalid addresses, or verify large lists with bulk email verification.
What it builds
DKIM signs outgoing mail with a private key and publishes the matching public key in DNS. A free DKIM generator turns the public half into the exact TXT record receivers expect, at the exact hostname they will query.
A DKIM record is published at selector._domainkey.yourdomain, not at the domain root. The selector is a label your sending provider chooses, and our DKIM record generator writes the full hostname so you do not guess it.
Publishing a perfect DKIM record at the wrong host is the single most common DKIM failure, and it is invisible until mail starts failing alignment.
v=DKIM1; k=rsa; p=<public key>. The private key stays with whatever signs your mail, and a free DKIM record generator only ever handles the public half.
Any DKIM generator asking for a private key is doing something you should refuse. A DKIM generator only ever needs the public half.
2048-bit DKIM keys are the modern default and are strong enough that key length stops being the weak link. 1024-bit exists because some legacy DNS providers truncate long TXT values.
This DKIM record generator emits the full record; if your DNS panel mangles it, that is a panel limitation rather than a DKIM one.
Every provider that sends as your domain needs its own DKIM selector and its own DKIM record. Google, your ESP, and your invoicing tool will each have one.
Run this DKIM generator once per provider. There is no single combined DKIM record, and trying to merge what a DKIM generator produced for two providers breaks both.
Reading the record
Four tags cover almost every DKIM record you will publish.
The version tag, and it must come first. A record without it is not a DKIM record and receivers skip it — every DKIM generator worth using emits it automatically.
Our DKIM generator always emits it, which removes one whole class of mistake.
The key type. RSA is what essentially every provider uses. Ed25519 exists in the specification and is rarely deployed.
Leave it as our DKIM generator wrote it unless your provider explicitly says otherwise.
The public key itself, base64 encoded. It is long, and long TXT values are exactly what DNS panels split badly.
After publishing, confirm what actually resolves with DKIM Checker, because a truncated public key produces a DKIM record that looks right and validates as broken.
Optional flags. t=y marks the DKIM record as testing; t=s requires strict subdomain matching. Most deployments need neither.
A record left in testing mode indefinitely is a common oversight, and receivers treat it accordingly. The free DKIM record generator leaves both flags off by default.
Publishing
Four steps, and the third is where most DKIM deployments quietly fail.
Google Workspace, Microsoft 365, Mailchimp, SendGrid, and Mailgun all generate the key pair for you and show the public half. Paste it into a DKIM generator with the selector they gave you.
For a self-hosted mail server, generate the pair yourself and keep the private key on the signing host.
Host is selector._domainkey, type TXT, value is the string the DKIM generator produced. Not at the root, and not as a CNAME unless your provider explicitly asks for one.
Some providers use a CNAME so they can rotate the key without touching your DNS. Follow their instruction rather than our DKIM generator default in that case.
DNS panels split, wrap, and truncate long TXT values, and a DKIM public key is long. What the DKIM generator gave you and what your nameservers serve are not reliably identical.
Check with DKIM Checker once propagation finishes; our free DKIM record generator cannot see what your DNS provider did to its output.
Publishing DKIM record generator output does nothing until the provider actually signs. Turn signing on, send a test message, and read the Authentication-Results header.
DKIM passing but not aligning is a separate problem, and DMARC is what surfaces it.
Limits
DKIM is one of three sender records. Expecting it to cover the others is where most misconfiguration starts.
That is SPF. A message can carry a valid DKIM signature from an IP nothing authorised, and vice versa.
Publish both; a free DKIM DNS record generator output alone leaves half the picture missing.
Only DMARC ties an authenticated domain to the From address a recipient sees. DKIM proves a signature; alignment is what makes that signature meaningful.
Without DMARC, a valid DKIM signature on an attacker's own domain proves nothing about yours.
A forwarded message keeps its DKIM signature intact, which is why DKIM matters more than SPF for mailing lists. A message modified in transit breaks the signature.
Footer-appending list software is the usual culprit, and no DKIM generator setting prevents it.
A perfect DKIM record does not mean the addresses you send to exist. Sender authentication and recipient verification are separate problems.
For the recipient side, use Email Verifier before a campaign — authentication and list hygiene are two halves of the same sending workflow.
Reference
DKIM is defined by the IETF, and the tools around this DKIM generator cover the checks a DKIM generator does not.
The IETF's RFC 6376 defines DKIM, its tags, the selector convention, and the signing process this DKIM record generator produces keys for.
Every tag the free DKIM record generator emits maps to a section of that document.
After publishing, the DKIM Checker resolves the live DKIM record at your selector and validates the key.
Generate with the free DKIM record generator here, verify there — that pairing catches the DNS-panel mangling no DKIM generator can see.
DKIM is one third. The SPF Record Generator and the DMARC generator cover IP authorisation and From-domain alignment.
A domain with DKIM but no DMARC is signed and still spoofable in the one place users look, whatever the DKIM generator produced.
Nineteen free tools alongside the paid AI features, none of them requiring an account.
Free Tools
Free DKIM record checker: resolve the live DKIM record at any selector, validate the public key, and flag truncation or testing mode. A DKIM record checker and validator.
Domain or infrastructure evidence — not mailbox proof.
Free Tools
Free SPF record generator: build a valid v=spf1 TXT record for any domain in seconds. SPF record generator, no signup, with the 10-lookup limit checked.
Free Tools
Free DMARC record generator: build a valid v=DMARC1 TXT record with policy, alignment, and reporting tags in seconds. Free DMARC policy record generator, no signup.
Free Tools
Free DNS record lookup for any domain: A, AAAA, MX, TXT, NS, CNAME, SOA resolved live from authoritative nameservers. DNS record lookup tool, free, no signup.
Email Tools
Free email deliverability test: send one message and get authentication, DNS, spam-filter, blacklist, header, and content scores. A free email inbox placement test, no signup.
Sender or message diagnostics — not address discovery.
Email Verify Tools
Check if an email address is valid with a free email verifier, no signup — syntax, MX, SMTP mailbox, disposable, role and catch-all checks.
Recipient evidence — not sender or DNS configuration.
Yes — a free DKIM record generator with no signup and no account. Build as many DKIM records as you need. The DKIM generator runs entirely on the page and never sees a private key, which is what makes a browser-side DKIM generator safe to use.
At selector._domainkey.yourdomain as a TXT record — not at the domain root. The DKIM generator prints the exact hostname. Some providers use a CNAME instead so they can rotate the key without touching your DNS; follow their instruction rather than the DKIM generator default in that case.
A label your sending provider chooses, used as the first part of the DKIM hostname. Google uses google, SendGrid uses s1 and s2, and so on. Our free DKIM record generator asks for it because a record published without the right selector is unreachable, and no DKIM generator can guess it for you.
Yes, and you usually need it to. Each sending provider gets its own selector and its own record. Run the free DKIM record generator once per provider rather than trying to combine keys — the DKIM generator deliberately produces one record per run.
2048-bit. It is the modern default and strong enough that key length stops being the weak link. Use 1024 only if your DNS provider physically cannot store the longer TXT value our free DKIM record generator produces; the DKIM generator will emit either.
No. DKIM proves a signature; only DMARC ties an authenticated domain to the visible From address. A domain with a perfect record from any DKIM generator and no DMARC policy is signed and still spoofable, so treat the DKIM generator output as one of three steps.
A free DKIM DNS record generator, no signup. Generate the DKIM record, publish it at the selector, then verify what actually resolves.
Free DKIM DNS record generator · Correct DKIM selector hostname · 2048-bit DKIM by default · DKIM generator, no account
