DKIM Record Generator
AvailableGenerate a DKIM RSA key pair in your browser and get the DNS TXT record, host name, private key and public key ready to copy.
Your private key is created in this browser and never leaves it. Keep it secret: install it only on your mail server. If your mail provider can generate DKIM keys itself, prefer that.
Settings
Key length changed — press Generate again to create a matching key.
1DNS record name (subdomain)
Create a TXT record with this name. Many DNS panels add your domain automatically — then enter only the short form.
2DKIM record (TXT value)
Paste this as the value of the TXT record. v=DKIM1 marks a DKIM key, k=rsa is the key type and
p= is your public key.
Split into 255-character strings
A single TXT string holds at most 255 characters. If your DNS provider doesn’t split long values automatically, paste this quoted form instead.
3Private key — for your mail server
Your mail server (e.g. OpenDKIM, Postfix, Exim, a gateway or your email provider) signs outgoing mail with this key. Never publish or share it. Store it with restricted permissions (e.g. readable only by the signing service).
Both contain the same key. Use PKCS#1 if your software asks for an “RSA private key”.
4Public key
The same key as the p= value, in PEM format. Some mail servers and testing tools ask for it; it is safe to share.
Next steps
- Publish the TXT record (steps 1–2) and wait for DNS to update.
- Install the private key on your mail server and configure the selector
. - Verify the record with DKIM Lookup, then send a test message and check its signature with the Email Header Analyzer.
- Add a DMARC record so receivers act on DKIM and SPF results. Rotate keys periodically using a new selector.
How it works
Runs in your browser. An RSA key pair is generated with the Web Crypto API. The public key becomes the p= value of a TXT record published at <selector>._domainkey.<domain>; your mail server signs outgoing messages with the private key, and receivers verify the signature with the published public key.
Safeguards & responsible use
- Keys are generated locally with the Web Crypto API — the private key is never sent to NetTools or stored.
- Treat the private key like a password: install it on your mail server only and never publish or email it.
- Generated records are suggestions: review them and verify with DKIM Lookup after publishing.
Frequently asked questions
What is a DKIM selector?
A name you choose that identifies one key, so a domain can have several (per provider or for rotation). It appears as s= in the DKIM-Signature header and in the DNS host name.
Which key length should I use?
2048-bit RSA is the common recommendation. 1024-bit keys are considered weak; 4096-bit records are long and not handled well by every DNS provider.
Why is the record split into several strings?
A single DNS TXT string can hold at most 255 characters. Longer values are published as several quoted strings in one record; receivers join them. Many DNS panels do this automatically.
Should I generate keys here or on my mail server?
If your mail server or provider can generate DKIM keys (for example opendkim-genkey or your email provider’s admin console), prefer that — the private key then never leaves the server. This tool is for setups where you must supply your own key.