DKIM Record Generator

What this generator does, and what it does not

The generator takes a selector, a domain, a key type and a public key, and formats them into the two things your DNS provider asks for: the record name (selector._domainkey.yourdomain.com) and the TXT value (v=DKIM1; k=rsa; p=...). It strips PEM headers and all whitespace from the pasted key so the value is one continuous string.

It does not create a key pair. The private key must be generated by the system that signs your mail, which is normally your mail platform, or by you with a tool such as OpenSSL if you run your own mail server. Only the public key goes into DNS. Never paste a private key into any web form.

The record, tag by tag

Name:  google._domainkey.example.com
Type:  TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...IDAQAB

Step by step: publish a DKIM record

1. Generate the key in your mail platform (see the provider notes below) or with OpenSSL, and note the selector name the platform gives you.
2. Paste the public key into the generator. A full PEM block is fine; the BEGIN and END lines are removed automatically.
3. Enter the selector and your domain, then choose the key type that matches how the key was generated.
4. In your DNS provider, add a TXT record with the host set to selector._domainkey. Most providers append the domain automatically, so do not type it twice.
5. Paste the value as one string. If your provider splits long values into several quoted chunks, that is normal and valid, since a single DNS string is limited to 255 characters and a 2048-bit key is longer than that.
6. Wait for the TTL, then confirm with the DKIM checker using your selector, and only then switch on signing in your platform.

Generating your own key with OpenSSL

Only needed if you run your own mail server or signing software. Keep private.pem on the server and publish only the second command's output as the p= value.

openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -pubout -outform der | openssl base64 -A

For Ed25519, p= must be the raw 32-byte public key in base64 (44 characters), as defined in RFC 8463, not the longer DER wrapper that OpenSSL prints by default. Because not every receiver verifies Ed25519 signatures, the usual approach is to sign with both an RSA and an Ed25519 key under different selectors. If you are unsure, use RSA.

Provider notes

Rule of thumb: if the platform tells you to add a CNAME, add the CNAME. If it gives you a long p= key, this generator formats it as TXT.

Troubleshooting a record that does not verify

• Key pasted with line breaks or extra spaces: the generator removes them, but a value edited by hand afterwards may break again.
• Selector or domain typo: the record name must match the s= and d= values in the DKIM-Signature header exactly.
• Host entered with the domain duplicated, for example google._domainkey.example.com.example.com: check how your DNS provider treats the host field.
• RSA key published as ed25519, or the reverse: k= must match the key that was actually generated.
• Signing enabled before the record propagated: wait for the TTL and re-check before enabling.

Limitations of this generator

• It does not validate the key. Pasting random text still produces a record that looks complete. Verify with the DKIM checker.
• It only writes v, k and p tags. Flags such as t=s and tags like h= and n= must be added by hand.
• It does not generate or store keys, and it does not talk to your mail platform.
• The domain field is used as typed. If your platform signs as a subdomain, use that subdomain.
• Publishing the record is only half of DKIM. The platform must be signing outgoing mail with the matching private key.

Related tools and guides