DKIM Generator: How to Create a DKIM Key (and Verify It)

What a DKIM Generator Does

A DKIM generator creates two things:

1. Private key — kept on your sending server, used to sign outgoing messages
2. Public key — published in DNS as a TXT record, used by receivers to verify signatures

Receivers fetch the public key from your DNS, decrypt the signature in the message header, and verify it matches. If it matches, DKIM passes — proving the message came from your domain and wasn't tampered with in transit.

When You Need to Use a DKIM Generator

Most senders don't need a standalone DKIM generator — their ESP handles it:

• Google Workspace: Admin Console → Apps → Google Workspace → Gmail → Authenticate Email → Generate New Record
• Microsoft 365: Defender Portal → Email & collaboration → Policies → Email Authentication → DKIM
• SendGrid: Settings → Sender Authentication → Domain Authentication
• Mailgun: Sending → Domain Settings → DKIM
• Postmark: Settings → DKIM

When you do need a standalone DKIM generator:

• Self-hosted mail server (Postfix, Mailcow, Stalwart)
• Custom application sending mail directly
• Adding DKIM signing in front of an ESP that doesn't support it
• Generating a DKIM selector generator key for testing

Free DKIM Generators

These free DKIM generators all produce valid key pairs:

Tool	URL	Notes
EasyDMARC	easydmarc.com/tools/dkim-record-generator	Clean interface, 1024 and 2048-bit options
PowerDMARC	powerdmarc.com/dkim-record-generator	Includes selector wizard
ZeroBounce	zerobounce.net/dkim-generator	Free DKIM generator, no signup
MXToolbox	mxtoolbox.com/dkim.aspx	Generator + verifier in one tool
Smartlead	smartlead.ai/free-dkim-generator	Free DKIM tool from a cold email platform
Socket Labs Tools	tools.socketlabs.com	Multi-purpose DNS tools

For port-25 specific use cases, EasyDMARC's DKIM generator port 25 mode produces keys appropriate for direct SMTP sending.

How to Add a DKIM Record (Step by Step)

1. Generate the key pair

Pick a generator (or use your ESP). Generate a 2048-bit RSA key. You'll receive:

• A private key (looks like -----BEGIN RSA PRIVATE KEY-----...)
• A public key in TXT-record format

2. Choose a selector

Use a meaningful name: google for Google Workspace, s1 for service 1, mg for Mailgun, etc. Each sender gets its own selector.

3. Add DKIM record to DNS

Create a TXT record at selector._domainkey.yourdomain.com. Value is the public key string from your generator — usually starts with v=DKIM1; k=rsa; p=....

4. Configure signing

Tell your sending server (or ESP) to sign outgoing messages using the private key. Most ESPs handle this automatically once you publish the DNS record.

5. Verify

Send a test email to [email protected] or use MXToolbox DKIM Lookup. Should show "pass" with your selector.

Generating DKIM with OpenSSL (Command Line)

For self-hosted setups:

# Generate 2048-bit private key
openssl genrsa -out dkim_private.key 2048

# Extract public key
openssl rsa -in dkim_private.key -pubout -out dkim_public.key

# Format public key as DNS TXT value
cat dkim_public.key | grep -v "PUBLIC KEY" | tr -d '\n'

Take the resulting string, prepend v=DKIM1; k=rsa; p=, and publish as TXT at your chosen selector.

DKIM Key Length: 1024 vs 2048

Use 2048-bit keys. 1024 is technically still supported but considered weak. Some providers (Gmail, Microsoft) now flag 1024-bit DKIM as suboptimal. See DKIM key length.

The only reason to use 1024-bit: your DNS provider limits TXT record length and you can't split a 2048-bit key. Modern DNS providers all support long records.

Common DKIM Generator Mistakes

• Wrong selector format: Selectors are alphanumeric (plus - and _). No special characters.
• Publishing key with line breaks: Some DNS interfaces require you to strip line breaks from the public key.
• Wrong record location: It's selector._domainkey.yourdomain.com, not _dkim or dkim.
• Missing v=DKIM1; k=rsa; prefix: The full TXT value needs the version and key type tags.
• Old key still active: After rotation, leave the old DKIM key published for 7-14 days so in-flight messages still verify.

Practitioner note: I run into the same DKIM generator confusion repeatedly: senders generate a key with one tool, paste it into DNS, and forget to actually configure their sending server to use the matching private key. The DNS record is half the work. The other half is the server signing with the matching private key.

Practitioner note: For cold email infrastructure with multiple sending domains, generate a unique DKIM key per domain — never reuse keys across domains. Each domain needs its own private key. This is sometimes confused with selectors (which let you have multiple keys per domain), but the principle is one-domain-one-private-key.

Practitioner note: When using a free DKIM generator online, the private key is generated client-side in your browser (for reputable tools). If you're paranoid about a tool seeing your private key, use OpenSSL locally instead. The math is the same; the trust model is different.

If you need help configuring DKIM signing across multiple sending sources, generating keys, or rotating compromised keys, book a consultation. I configure DKIM at scale for senders using multiple ESPs and self-hosted infrastructure.

Sources

• RFC 6376: DomainKeys Identified Mail (DKIM)
• Google: DKIM setup for Workspace
• Microsoft: DKIM configuration for Microsoft 365
• M3AAWG: DKIM Best Practices

---

v1.0 · May 2026