DKIM Key Generator

DKIM (DomainKeys Identified Mail) is an email authentication standard that allows senders to sign outgoing email with a private key. Receiving servers verify the signature using a public key published in a DNS TXT record. DKIM proves the email was sent by an authorised server and that the message content was not altered in transit. It is a core component of email authentication alongside SPF and DMARC, and is essential for inbox placement and passing DMARC checks.

2048-bit keys are the current recommended standard — they provide strong security and are supported by all modern mail servers. 1024-bit keys are considered weak by today's standards and should be avoided for new setups; some providers already reject 1024-bit DKIM signatures. 4096-bit keys provide maximum security but some older DNS providers have TXT record length limits that prevent publishing them. 2048-bit is the best balance of security and compatibility.

A DKIM selector is a label that allows a domain to publish multiple DKIM public keys simultaneously. The selector is prepended to _domainkey to form the DNS record name: selector._domainkey.example.com. Selectors let you rotate keys without disrupting mail flow — you publish the new key under a different selector, update your mail server to sign with the new key, then delete the old DNS record once the old key is no longer in use. Common selectors are date-based (e.g. 2024, jan2024) or service-based (google, mailchimp).

To rotate DKIM keys: (1) Generate a new key pair with a new selector name. (2) Publish the new public key as a DNS TXT record at newselector._domainkey.yourdomain.com. (3) Wait for the DNS change to propagate (allow the TTL to expire). (4) Update your mail server configuration to sign with the new private key and new selector. (5) Send test emails and verify DKIM passes. (6) After confirming everything works, delete the old DNS TXT record.