DKIM Record Generator – Complete Guide to DKIM Keys and DNS Records

DKIM is the email authentication method that survives forwarding and mailing lists, and it is the one DMARC usually depends on when a third-party service sends mail for you. Setting it up means two halves that must match: a private key on the system that signs outgoing mail, and the corresponding public key in DNS at a selector name. Many hosted providers do this for you. When yours does not, for example with a self-hosted Postfix, a mail gateway or an application that signs mail itself, you need to create the key pair and the record yourself.

The DKIM Record Generator creates an RSA key pair in your browser and gives you everything ready to copy: the DNS record name, the TXT value (also pre-split into 255-character strings), the private key in PKCS#8 or PKCS#1 format and the public key in PEM. The private key is created locally with the Web Crypto API and never leaves your browser.

What is a DKIM record generator?

In simple terms

DKIM (DomainKeys Identified Mail) puts a digital signature on every outgoing message. Your mail server signs with a private key; receivers fetch the public key from your DNS and check that the signature is valid and the signed parts of the message were not changed. The generator makes both keys and formats the public one as the DNS record you need to publish.

Technical background

DKIM is defined in RFC 6376. The signer adds a DKIM-Signature header containing, among others, d= (the signing domain), s= (the selector), a= (the algorithm, here rsa-sha256), a hash of the body and a signature over selected headers. The verifier queries the TXT record at:

<selector>._domainkey.<domain>

The record holds tags such as v=DKIM1 (version), k=rsa (key type) and p= (the base64-encoded public key in SubjectPublicKeyInfo form). An empty p= means the key has been revoked.

For DMARC, a valid DKIM signature counts when its d= domain is aligned with the visible From: domain. Because the signature travels with the message, DKIM still passes after forwarding, where SPF typically fails.

RFC 8301 requires signers to use RSA keys of at least 1024 bits, recommends at least 2048, and requires verifiers to handle keys from 1024 to 4096 bits. A 2048-bit public key encoded in base64 is around 400 characters, so the TXT value must be published as more than one 255-character string.

Why use a DKIM record generator?

• Self-hosted or custom signing. Postfix with OpenDKIM, Exim, mail gateways, appliances and applications often expect you to provide the key.
• No OpenSSL needed. You get a correctly formatted key pair without running openssl genrsa and extracting the base64 public key by hand.
• Ready-to-paste DNS values. The full name, the short form for DNS panels that append the domain, the full TXT value and the split version.
• Both private key formats. PKCS#8 and PKCS#1 for software that is picky about the PEM header.
• Clear key-size guidance. 1024, 2048 and 4096 bits, each with a short note on its trade-offs.

Who should use it?

• Administrators running their own MTA (Postfix, Exim, Sendmail) with a DKIM milter or module.
• Teams configuring a mail gateway, relay or appliance that requires an uploaded key.
• Developers whose application signs outgoing mail itself.
• Anyone rotating a DKIM key where the platform requires a supplied key.

If your mail provider can generate the key for you, that is usually the better option, because the private key then never exists outside the provider.

How the DKIM generator works

When you press Generate DKIM record, the page calls crypto.subtle.generateKey in your browser with RSASSA-PKCS1-v1_5, SHA-256, public exponent 65537 and the modulus length you chose. It then exports:

• the public key as SubjectPublicKeyInfo (SPKI), encoded in base64 for the p= tag and as a PEM block (BEGIN PUBLIC KEY);
• the private key as PKCS#8 (BEGIN PRIVATE KEY), and converted locally to PKCS#1 (BEGIN RSA PRIVATE KEY) by unwrapping the PKCS#8 structure.

The DNS value is built as v=DKIM1; k=rsa; p=<public key> and split into 255-character strings. Domain and selector only affect the record name, so changing them updates the output without generating a new key; changing the key length shows a notice that you need to press Generate again. Generating a 4096-bit key can take a few seconds.

Nothing is sent to NetTools.tech: no request is made with the key, and the download is created in the browser as a local file. When you leave the page, the keys are removed from it so they are not kept in the browser's back/forward cache.

How to use the NetTools.tech DKIM generator

1. Open the DKIM Record Generator.
2. Enter the Domain used in your From: address, for example example.com.
3. Keep or change the Selector. It is pre-filled with dkim plus the current year and month (such as dkim202610), which makes rotation easy to track. Letters, digits and hyphens are allowed; dots separate labels.
4. Choose a Key length: 1024-bit RSA (weak, legacy only), 2048-bit RSA (recommended, default) or 4096-bit RSA (long DNS record).
5. Press Generate DKIM record.
6. Step 1, DNS record name: copy the full name or the short form (<selector>._domainkey) and create a TXT record with it.
7. Step 2, DKIM record: copy the TXT value. If your DNS provider does not split long values, open Split into 255-character strings and copy that form instead.
8. Step 3, Private key: choose PKCS#8 or PKCS#1, then Copy private key or Download .pem (saved as <selector>.private.pem), and install it on your mail server.
9. Step 4, Public key: copy it if your software or a test tool asks for the PEM public key.
10. Configure your mail server to sign with this key and selector, then verify with DKIM Lookup and a test message in the Email Header Analyzer.

Understanding the results

Example: a 2048-bit key for a self-hosted server

For domain example.com, selector dkim202610 and 2048 bits, the generator shows:

Full name:   dkim202610._domainkey.example.com
Short form:  dkim202610._domainkey
Record:      v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…

The 2048-bit value is a little over 400 characters, so the split view shows two strings. A zone-file entry looks like this (key shortened):

dkim202610._domainkey.example.com. 3600 IN TXT ( "v=DKIM1; k=rsa; p=MIIBIjANBgkq…" "…IDAQAB" )

For OpenDKIM you would save the PKCS#1 or PKCS#8 key as /etc/opendkim/keys/example.com/dkim202610.private, readable only by the opendkim user, and reference it in the KeyTable with selector dkim202610. After publishing, check the record:

dig +short TXT dkim202610._domainkey.example.com

Then send a message to a mailbox you control and look for dkim=pass header.d=example.com in its Authentication-Results.

Common use cases

• New self-hosted mail server that needs its first DKIM key.
• Key rotation: generate a new selector, publish it, switch signing, remove the old record later.
• Upgrading from 1024 to 2048 bits with a new selector, without touching the old one until the switch.
• Application or gateway signing where a PEM private key must be uploaded.
• Lab and staging setups where you need a working DKIM pair quickly.

Troubleshooting

DKIM Lookup finds no key

Check the record name first: if the panel appended the domain to a full name you get dkim202610._domainkey.example.com.example.com. Use the short form in such panels. Also wait for propagation; Email DNS Propagation covers MX, SPF, DMARC, MTA-STS and TLS-RPT, and DNS Propagation can query the DKIM TXT name directly.

Verification fails with "bad signature" or "key mismatch"

The private key on the server does not belong to the published public key, often because the key was regenerated after the DNS record was copied. Generate once, then copy all values from the same result. Also make sure the p= value was not broken by inserted spaces or line breaks.

The DNS panel refuses the record

Some panels limit TXT values to 255 characters per string. Use the split form. If the panel cannot store multiple strings at all, a 1024-bit key fits in one string, but it is weak; changing DNS providers or using a CNAME to a provider-hosted key is the better fix.

The signing software rejects the private key

Switch between PKCS#8 and PKCS#1. Software that expects BEGIN RSA PRIVATE KEY will not load BEGIN PRIVATE KEY, and vice versa. Also check file permissions and line endings when copying from Windows.

Common mistakes

• Emailing the private key to a colleague or pasting it into a ticket. Treat it like a password.
• Publishing the private key in DNS instead of the p= public key.
• Regenerating after publishing, so DNS and the server hold different keys.
• Reusing one selector for different keys, which breaks verification of mail in transit during the switch.
• Signing with a d= domain that is not aligned with the From: domain, so DKIM passes but DMARC does not.
• Choosing 1024 bits without a hard technical reason.

Limitations

• RSA only (k=rsa); Ed25519 keys are not generated.
• The record contains only v, k and p; flags such as t=y (testing) or h= are not added.
• The generator does not configure or test your mail server, and it does not check DNS. Use DKIM Lookup and a real test message for that.
• Key generation depends on your browser's Web Crypto support. If generation fails, the page shows the error instead of a key.
• The tool cannot protect a key once it is copied or downloaded; storage and access control on the server are your responsibility.

Security & privacy

Key generation happens entirely in your browser with the Web Crypto API. The private key is never sent to NetTools.tech, never stored by the site, and removed from the page when you navigate away; the .pem download is created locally. Domain and selector also stay in the browser. Still, the key is only as safe as the device you generate it on: use a trusted, up-to-date machine, avoid shared computers, install the key with restrictive permissions (readable only by the signing service), and delete downloaded copies once installed. If your provider or mail server can create the key itself, that keeps the private key off your workstation entirely.

Related tools

• DKIM Lookup – check the published key, its type and length (guide).
• Email Header Analyzer – confirm dkim=pass and the selector in a real message (guide).
• DMARC Record Generator – make receivers act on DKIM and SPF results (guide).
• SPF Record Generator – the other half of sender authentication (guide).
• Email tools overview – how the email tools fit together.

Summary

DKIM signs outgoing mail with a private key and lets receivers verify it with a public key published at selector._domainkey.domain. The NetTools.tech DKIM Record Generator creates an RSA key pair locally with Web Crypto, formats the TXT record, offers both private key formats, and never uploads the private key. Publish the record, install the key on the signing server, and verify with DKIM Lookup and a test message.