Skip to main content

Web Tools

DKIM Record Generator

Build a DKIM TXT record for email signing.

DKIM Record Generator tool

Loading tool…

Jump to a section

About This Tool

DKIM lets a mail provider sign outgoing messages so receivers can verify that the message was authorized by the domain and not changed in transit. This generator turns a selector, domain, key type, and public key into the DNS TXT host and value used for DKIM publishing. It is useful when copying a key from Google Workspace, Brevo, SendGrid, Mailgun, or another email provider into Cloudflare or a registrar DNS dashboard.

How To Use It

  1. Enter the domain that will sign email, such as example.com.
  2. Enter the selector supplied by your mail provider, such as google, default, s1, or 2026key.
  3. Paste only the public DKIM key. Never paste or publish a private key.
  4. Copy the generated host and TXT value into your DNS provider. For a long value, use the quoted/chunked version when the provider requires 255-byte TXT strings.
  5. After publishing, enable DKIM signing in your mail provider and send a fresh test email to inspect headers.

Examples

Google Workspace DKIM

Use the selector and public key generated in Google Admin, then publish selector._domainkey.example.com as a TXT record.

Transactional email provider

Providers such as Brevo, SendGrid, and Mailgun often provide DKIM selectors and keys during sender/domain authentication.

Long public keys

Large RSA keys can create TXT values longer than 255 characters. Use the generated quoted/chunked value when your DNS dashboard does not split it automatically.

Useful Notes

What DKIM checks

DKIM adds a cryptographic signature to outgoing email. Receiving servers use the selector and signing domain in the message header to find the DNS public key and verify the signature.

Selector host format

A DKIM record is usually published at selector._domainkey.example.com. A selector can contain period-separated components, such as march2026.reykjavik. Some DNS dashboards ask only for selector._domainkey because they append the root domain automatically.

Public key safety

The p tag contains a public key and is meant to be published in DNS. A private key must never be pasted into DNS, committed to code, or shared in screenshots.

Long TXT values and quoted chunks

A DNS TXT record can contain multiple quoted character-strings that are joined into one logical value. When the DKIM value exceeds 255 bytes, the generator provides a chunked form with each quoted string within that limit. Publish the chunks as one TXT record, not as separate records.

Ed25519 key length

An Ed25519 DKIM public key is exactly 32 bytes and appears as 44 base64 characters ending in =. The generator checks this size when Ed25519 is selected; RSA keys use a different encoded structure and length.

Use with SPF and DMARC

DKIM works best with SPF and DMARC. SPF authorizes sending servers, DKIM signs messages, and DMARC checks whether SPF or DKIM aligns with the visible From domain.

Limitations

This tool validates record shape locally. It does not generate cryptographic keys, verify signatures, query live DNS, or confirm that a provider has started signing mail.

FAQ

Where do I add a DKIM record?

Add it as a DNS TXT record at selector._domainkey for your domain, using the selector provided by your email service.

Can this generate a DKIM private key?

No. Key generation should happen in your mail provider or a secure local environment. This tool only formats a public key for DNS.

Why does the tool warn about long TXT values?

Each DNS TXT character-string is limited to 255 bytes. Many providers split long values automatically; if yours does not, copy the generated quoted/chunked form as one logical TXT record.

Does this upload my DKIM key?

No. The generator runs locally in the browser and does not send the entered values anywhere.