b2KIT

DKIM Record Generator

Generate DKIM key pairs and DNS TXT records for email authentication and anti-spoofing protection.

Tested tool guide Tested browser tools Checked August 16, 2026

What DKIM Record Generator does and how it behaves

Create the two artifacts needed to configure DKIM for a sending domain: a private signing key and a DNS TXT record containing the matching public key. The selector and domain determine the record name, such as mail._domainkey.example.com. The private key belongs in the outbound mail system, while the public-key record is published through DNS. The critical distinction is that the private key must never be placed in DNS or otherwise made public. Generation happens in the browser, so the key material is not uploaded by this tool.

How the result is produced

1

Key pair and selector

The generator creates mathematically related private and public keys. A mail signer uses the private key to produce DKIM signatures. The selector provides a name for this particular key, allowing one domain to maintain several keys or rotate to a replacement without immediately removing an older key.

2

DNS lookup record

The public key is formatted as a DKIM TXT record whose owner is the selector followed by ._domainkey and the signing domain. Its p= tag carries the encoded public-key data. A receiving system reads the selector and signing domain from the message's DKIM-Signature header, retrieves that TXT record, and uses its public key for verification.

Good uses

  • Preparing the first DKIM key and DNS record for a custom outbound email domain.
  • Rotating an existing DKIM key by generating a replacement under a new selector.
  • Assigning separate selectors and keys to transactional, marketing, or third-party mail systems.

Limits and checks

  • Key generation is intentionally variable, so identical domain and selector entries do not imply identical key material or TXT output.
  • DNS control panels differ: some expect only the selector._domainkey host portion and append the zone name automatically. Confirm the final fully qualified record name.
  • A valid DKIM record does not make unsigned mail pass DKIM, encrypt messages, or by itself stop all address spoofing. The sending system must sign with the matching private key.

Common questions

Can I publish the generated private key in DNS?

No. Publish only the TXT record containing the public key. The private key must remain restricted to the system that signs outgoing messages. Anyone who obtains it may be able to create signatures that verify against the published record. If it is exposed, replace it with a newly generated key under a new selector.

Does adding the TXT record immediately enable DKIM?

No. The outbound mail service must also be configured with the matching private key, signing domain, and selector. Its generated DKIM-Signature header must point receivers to the same DNS record. DNS changes may also take time to become visible through resolvers. DKIM verification and DMARC policy evaluation are related but separate.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.