DKIM Key Pair Generator
Generates a real DKIM key pair using your browser's built-in Web Crypto API. The private key is generated and stays entirely in this browser tab. It is never sent anywhere. Refreshing or closing this page discards it, so save it somewhere safe before you leave.
📖 Guide: How DKIM signing works
Last updated: September 9, 2026
How to use this tool
- Enter your domain, and a selector if you already know it, then click "Check current record" (Step 1) to see what's already published before you replace it.
- Choose a new selector for the key you're about to generate: a short label of your choosing that lets you run more than one DKIM key at once, useful for key rotation.
- Click Generate Key Pair (Step 2) — the key is created locally by your browser's Web Crypto API and never sent anywhere.
- Publish the TXT record (hostname and value) shown, through your DNS provider.
- Copy or download the private key and load it into your mail server's DKIM signer (e.g. OpenDKIM) before you start sending, then save it somewhere safe — refreshing this page discards it for good.
Sample record
A finished DKIM record looks like this, published as a TXT record at dkim2026._domainkey.example.com:
It's needed so receiving mail servers can verify the cryptographic signature your mail server attaches to outgoing mail — confirming the message wasn't altered in transit and really did come from a server you control. It's one of the three pillars of email authentication, alongside SPF and DMARC.
Step 1: Check what's published now
DKIM has no discovery mechanism, so this probes common provider selectors (plus the selector above, if you know it) against live DNS — see what's already there before you generate a new key and overwrite it.
Step 2: Generate a new key pair
Pick a selector that doesn't collide with one found above (useful for key rotation), then generate.