01DKIM, the signature of your emails
DKIM (DomainKeys Identified Mail) has your server cryptographically sign every outgoing email: the private key signs, and receiving mailbox providers verify the signature with the public key you publish in the DNS, under selector._domainkey.your-domain. A valid signature proves the message really comes from your domain and was not altered in transit — together with SPF, it is one of the two pillars DMARC relies on.
One important point: if you send through Google Workspace, Microsoft 365, Brevo, Mailjet…, the provider generates the key and hands you the record to publish — you do not need this generator. It is for when you run the sending server (Postfix + OpenDKIM, rspamd, Exim, an appliance) or when a piece of software asks you to supply your own key pair.
02Understanding each field
- Selector
- The name that distinguishes this key from others (s2026, mail…): it appears in every email's signature and in the DNS record name. A domain can publish several keys under different selectors.
- RSA 2048
- The current standard: accepted everywhere, good strength/size balance. RFC 8301 mandates at least 1024 bits and recommends 2048.
- RSA 4096
- Stronger, but the TXT record exceeds 255 characters (splitting required) and some older verifiers reject it. Rarely useful: rotating 2048-bit keys is preferred.
- Ed25519
- A modern elliptic curve (RFC 8463): tiny key, fast signature. Mailbox-provider support is still partial — publish it under a second selector, alongside RSA.
- p=
- The public key, base64-encoded in the TXT record. Emptying it (p=) revokes the key.
- Private key
- The PEM file to install on the signing server. Never share it: whoever holds it can sign emails on behalf of your domain.
03Publish, install, verify
1. Publish the TXT record in your domain's DNS zone (host selector._domainkey). 2. Install the private key in your signing software (OpenDKIM: KeyFile; rspamd: dkim_signing.conf) with the same selector. 3. Email yourself and look at the DKIM-Signature header and the dkim=pass verdict.
Then verify the publication with our email check by filling in the selector — it also checks SPF and DMARC, which you can generate with the SPF & DMARC generator. Follow the record's propagation with the DNS propagation check.
04Frequently asked questions
Is it safe to generate a private key in a browser?
Yes: generation uses the WebCrypto API, the browser's cryptographic random number generator — the same quality level as a local openssl. Above all, nothing is transmitted: no network request leaves this page during generation, which you can verify in the developer tools' Network tab. The only copy of the private key is the one you paste onto your server.
RSA 2048 or 4096: which should I pick?
2048. It is RFC 8301's recommendation, it is accepted by all verifiers, and the record fits with minimal splitting. In practice 4096 only brings a bulky record and incompatibilities: good hygiene is not a bigger key, it is regular rotation (a new key and selector every year, for instance).
What is the selector, concretely?
A simple label that lets one domain hold several keys in parallel. A signed email carries s=selector in its DKIM-Signature header; the recipient fetches the public key from the DNS at selector._domainkey.domain. This enables zero-downtime rotation: publish the new key under a new selector, switch the signing, then remove the old one.
My sending provider already gave me a DKIM record: should I generate another one?
No. When sending goes through a provider (Google Workspace, Microsoft 365, Brevo, Mailjet…), the provider holds the private key and signs your emails: publish the record it gives you, that's all. This generator is only for sending servers you administer yourself.
How do I revoke or rotate a DKIM key?
To revoke: publish the record with an empty p= (the RFC covers this case) or remove it after a delay. For rotation, the clean method: generate a new pair under a new selector, publish it, configure the server to sign with it, confirm dkim=pass, then remove the old record after a few days — emails still in transit remain verifiable.