DKIM Record Generator

DomainKeys Identified Mail (DKIM) is an email authentication method that allows the sender to cryptographically sign email messages. The signature is verified by the receiving server using a public key published in the sender's DNS as a TXT record. DKIM helps ensure email integrity and authenticity, preventing tampering and spoofing.

A DKIM DNS record contains the version tag (v=DKIM1), the hash algorithm (h=sha256), the key type (k=rsa), and the public key (p=...). The record is published at a specific DNS name constructed from the selector and domain: <selector>._domainkey.<domain>. Each email service or sending infrastructure can use a different selector, allowing key rotation without disrupting service.

Common use cases include authenticating email sent through Google Workspace, Microsoft 365, SendGrid, Mailgun, Amazon SES, and other email service providers. DKIM is typically used alongside SPF and DMARC for comprehensive email authentication.

1. Enter your domain — Type the domain you use for sending email (e.g., example.com).
2. Choose a selector — Enter a unique selector name. Common selectors include google (for Google Workspace), sendgrid, mailgun, or default. Your email provider will tell you which selector to use.
3. Select key length — Choose 2048-bit for most providers. Some older providers may require 1024-bit.
4. Generate your key pair — Use OpenSSL or your email provider's admin console to generate an RSA key pair. Replace the example public key in the generated record with your actual Base64-encoded public key.
5. Publish the record — Add the TXT record to your DNS zone at <selector>._domainkey.<domain>. Then enable DKIM signing in your email server or provider settings.