Tools

DKIM key generator

Generate a DKIM RSA key pair in your browser. Get a DNS TXT record, a public PEM, and a private PEM. Nothing is uploaded.

Set the domain and selector, then generate. 4096-bit keys take longer.

How to generate a DKIM key

  1. Enter the signing domain and a selector (common values: mail, default, google).
  2. Choose 2048-bit RSA unless a provider requires 4096. Click Generate keys.
  3. Publish the DNS TXT record. Store the private PEM on the mail server only — not in git, not in wwwroot.

DNS record shape

The name is selector._domainkey.domain. The value is v=DKIM1; k=rsa; p= plus the base64 PKCS#1 public key. Long values are split into 240-character quoted chunks so they fit DNS TXT limits. Paste those chunks into one TXT record at your registrar or in BIND.

Nothing is uploaded

Key generation uses Web Crypto in this tab. Geek University never sees the private key. Pair this with the email hash tool when you are setting up mail privacy. More utilities live on tools.

DKIM key generator FAQ

Does this DKIM generator upload my keys?

No. RSA key generation runs in your browser. Refresh the page and the private key is gone unless you saved it.

2048 or 4096 bits?

2048-bit RSA is the usual DKIM size and generates quickly. 4096-bit keys are stronger and slower; some DNS hosts also struggle with the longer TXT record.

What is a DKIM selector?

A label so one domain can publish more than one key. The DNS name is selector._domainkey.your-domain. Rotate by publishing a new selector, then switching the signer.

PKCS#8 or PKCS#1?

The private PEM is PKCS#8 (BEGIN PRIVATE KEY), which OpenDKIM, Postfix, and most panels accept. The DNS p= value is the PKCS#1 RSA public key, as RFC 6376 requires.

Is the DKIM key generator free?

Yes. There is no account. Generate keys on a machine you trust, then store the private file with the same care as an SSL key.