DKIM Key Generator
🔒 In your browserGenerate a DKIM key pair in your browser — private key never leaves it.
How it works
Generate a DKIM key pair for signing your outgoing email. You publish the public key as a DNS TXT record and give the private key to your mail server. The key pair is generated in your browser with the Web Crypto API — the private key is never transmitted.
🔒 Generated with the Web Crypto API entirely in this browser. Neither key is uploaded.
🔒 Runs in your browser: records, keys and headers are processed locally and never uploaded — including DKIM private keys, which never leave this device.
About the DKIM Key Generator
This free DKIM key generator creates an RSA key pair for signing your outgoing email. You publish the public half as a DNS TXT record and give the private half to your mail server, which uses it to sign every message you send.
The keys are generated in your browser with the Web Crypto API — the private key is never transmitted to us or anyone else. That matters: a leaked DKIM private key lets someone sign mail as your domain.
How to use the two keys
- Public key — publish as a TXT record at <selector>._domainkey.yourdomain.com.
- Private key — paste into your mail server or sending platform's DKIM settings.
- Then send yourself a message and confirm with the DKIM Checker.
Frequently asked questions
What key size should I use?
2048-bit is the current recommendation. Only drop to 1024-bit if your DNS provider can't store the longer record, since some receivers now treat 1024-bit as weak.
Is it safe to generate a private key in a browser?
Here, yes — it's generated locally with the Web Crypto API and never sent anywhere. It also isn't stored, so copy it before leaving the page.
What selector should I choose?
Anything you like, as long as it's consistent between DNS and your mail server. Many people use a name plus a date, like mail2026, which makes future key rotation easier.
How often should I rotate DKIM keys?
Every six to twelve months is common practice. Publish the new key under a new selector, switch your mail server to it, then remove the old record.