Free tool · Generate
DKIM record generator
Generate a DKIM key pair in your browser, or paste a public key a service gave you, and get the TXT record to publish. Nothing is sent to us.
Skip the key management
Groundmail creates a DKIM key for your domain, shows you the one record to publish, and signs every message with it. No private keys on your servers.
When you need this
If you run your own mail server (Postfix, Exim, a Node or Go SMTP library), you need a key pair: the private key signs, the public key goes in DNS. Hosted providers make the key for you and only give you the record.
The key pair is generated with your browser's Web Crypto API, so the private key never leaves your device.
Go deeper: SPF, DKIM and DMARC for transactional email
Questions
How do I generate a DKIM key?
Pick a selector, generate a 2048-bit RSA key pair, install the private key on the server that signs your mail, and publish v=DKIM1; k=rsa; p=<public key> as a TXT record at selector._domainkey.yourdomain.com.
Why is my DKIM record too long for my DNS provider?
A 2048-bit key is longer than the 255 characters one TXT string can hold. Most providers split it for you; for those that don't, tick the split option to get it as several quoted strings.
Is it safe to generate a DKIM key in the browser?
Yes. The key is made with your browser's built-in cryptography and nothing is uploaded. Save the private key somewhere safe: we never see it, so we can't recover it.