Web Tools
DKIM Record Generator
Build a DKIM TXT record for email signing.
DKIM details
Generated DKIM TXT record
Publish this as a DNS TXT record for the selector host.
google._domainkey.example.comv=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv9mT7r5q2zK0xY1fYk5b8eN4u2q8o6uS9X0h1p2q3r4s5t6u7v8w9x0y1z2a3b4c5d6e7f8g9h0iJQIDAQABgoogle._domainkey.example.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv9mT7r5q2zK0xY1fYk5b8eN4u2q8o6uS9X0h1p2q3r4s5t6u7v8w9x0y1z2a3b4c5d6e7f8g9h0iJQIDAQABEstimated public key size: 3072 bits
The DKIM record shape looks valid. Publish it, enable DKIM signing in your mail provider, then send a fresh test email.
Tag breakdown
| Tag | Meaning | Value |
|---|---|---|
| v | Version | DKIM1 |
| k | Key type | rsa |
| p | Public key | MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv9mT7r5q2zK0xY1fYk5b8eN4u2q8o6uS9X0h1p2q3r4s5t6u7v8w9x0y1z2a3b4c5d6e7f8g9h0iJQIDAQAB |
About This Tool
DKIM lets a mail provider sign outgoing messages so receivers can verify that the message was authorized by the domain and not changed in transit. This generator turns a selector, domain, key type, and public key into the DNS TXT host and value used for DKIM publishing. It is useful when copying a key from Google Workspace, Brevo, SendGrid, Mailgun, or another email provider into Cloudflare or a registrar DNS dashboard.
How To Use It
- Enter the domain that will sign email, such as example.com.
- Enter the selector supplied by your mail provider, such as google, default, s1, or 2026key.
- Paste only the public DKIM key. Never paste or publish a private key.
- Copy the generated host and TXT value into your DNS provider.
- After publishing, enable DKIM signing in your mail provider and send a fresh test email to inspect headers.
Examples
Google Workspace DKIM
Use the selector and public key generated in Google Admin, then publish selector._domainkey.example.com as a TXT record.
Transactional email provider
Providers such as Brevo, SendGrid, and Mailgun often provide DKIM selectors and keys during sender/domain authentication.
Long public keys
Large RSA keys can create TXT values longer than 255 characters. Some DNS dashboards split them automatically while others require quoted chunks.
Useful Notes
What DKIM checks
DKIM adds a cryptographic signature to outgoing email. Receiving servers use the selector and signing domain in the message header to find the DNS public key and verify the signature.
Selector host format
A DKIM record is usually published at selector._domainkey.example.com. Some DNS dashboards ask only for selector._domainkey because they append the root domain automatically.
Public key safety
The p tag contains a public key and is meant to be published in DNS. A private key must never be pasted into DNS, committed to code, or shared in screenshots.
Use with SPF and DMARC
DKIM works best with SPF and DMARC. SPF authorizes sending servers, DKIM signs messages, and DMARC checks whether SPF or DKIM aligns with the visible From domain.
Limitations
This tool validates record shape locally. It does not generate cryptographic keys, verify signatures, query live DNS, or confirm that a provider has started signing mail.
FAQ
Where do I add a DKIM record?
Add it as a DNS TXT record at selector._domainkey for your domain, using the selector provided by your email service.
Can this generate a DKIM private key?
No. Key generation should happen in your mail provider or a secure local environment. This tool only formats a public key for DNS.
Why does the tool warn about long TXT values?
DNS TXT strings may need splitting into quoted chunks when they are long. Many providers handle this automatically, but not all dashboards do.
Does this upload my DKIM key?
No. The generator runs locally in the browser and does not send the entered values anywhere.
Related Tools
SPF Record Generator
Build an SPF TXT record for domain email senders.
DMARC Record Generator
Build a DMARC TXT record for domain email protection.
DNS Record Validator
Check DNS record values before adding them to a provider.
Email Header Analyzer
Inspect SPF, DKIM, DMARC, and delivery path headers.