DKIM Key & Record Generator

About the DKIM Key & Record Generator

DKIM signs every message your domain sends with a private key on your mail server; receivers check the signature with the public key you publish in DNS as a TXT record at selector._domainkey.yourdomain. This page makes the key pair and everything around it: the DNS record as one value, split into 255-character strings for zone files and DNS hosts that need them, the private key in PEM form, and ready lines for OpenDKIM, Postfix and Exim.

The keys are made by your browser’s Web Crypto API and never leave this page: nothing is uploaded or stored, and the page works offline once loaded. Choose RSA 2048 (the size RFC 8301 recommends), RSA 1024 for a DNS host that cannot store a longer record, RSA 4096, or Ed25519 where your browser supports it. Already have a private key? Paste it and get its DNS record.

Without a pass, the free preview shows the record’s name and layout and the first lines of each file, with every key hidden after its first characters; copying, the downloads and the ZIP unlock with a Pro pass.

Common uses

• Setting up DKIM on your own mail server with OpenDKIM and Postfix, or with Exim.
• Rotating a DKIM key: a new selector and key, published before the old one is retired.
• Replacing a 1024-bit key with a 2048-bit one, as RFC 8301 recommends.
• Getting the DNS record for a private key you already have.

The record

The TXT record goes at selector._domainkey.yourdomain (many DNS host forms take just selector._domainkey in the name field and add the domain themselves). Its value is a list of tags (RFC 6376 §3.6.1): v=DKIM1 first, k=rsa or k=ed25519, and p= the public key in base64. For RSA that is the SubjectPublicKeyInfo, exactly as RFC 6376 Appendix C publishes it; for Ed25519 the raw 32-byte key (RFC 8463 §4.2). Optional tags:

• t=y: testing mode. Verifiers must treat the mail like unsigned mail even when a signature fails, which is useful while you set up. Remove it once signing works.
• t=s: the i= domain in signatures must be exactly the d= domain, not a subdomain.
• h=sha256: only SHA-256 signatures (rsa-sha1 must not be used anyway, RFC 8301 §3.1).

One TXT string holds at most 255 characters (RFC 1035 §3.3), and a 2048-bit record is longer, so it is published as several quoted strings in one record, which receivers join without spaces (RFC 6376 §3.6.2.2). Some DNS host forms split a long value for you; others want the quoted strings on one line (Route 53’s TXT format): both forms are given.

Choosing the key

• RSA 2048-bit: recommended. Signers must use at least 1024 bits and should use at least 2048; verifiers handle 1024 to 4096 bits (RFC 8301 §3.2).
• RSA 1024-bit: still valid and fits in one string, for DNS hosts that cannot store a longer record. Move to 2048 when you can.
• RSA 4096-bit: the largest size verifiers must accept; the record needs three strings.
• Ed25519 (RFC 8463): a short record and fast signatures. Signers should and verifiers must implement it (RFC 8463 §5); for receivers that do not check it yet, sign with an RSA key as well, under a second selector (§6 allows signatures with both algorithms). Your browser must support Ed25519 in its Web Crypto API to make one here.

Installing the key

• OpenDKIM reads a PEM private key from KeyFile, or from a KeyTable that maps a key name to domain, selector and file, with a SigningTable that says which From addresses use it ([opendkim.conf(5)](http://www.opendkim.org/opendkim.conf.5.html)). It refuses a key file that other users can read (RequireSafeKeys). Ed25519 keys need OpenDKIM 2.11 or later, SignatureAlgorithm ed25519-sha256 in single-key mode, or the algorithm as a fourth KeyTable field (OpenDKIM’s development documentation).
• Postfix hands mail to OpenDKIM with smtpd_milters and non_smtpd_milters (MILTER_README); note that Postfix writes the address as inet:localhost:8891 while OpenDKIM’s Socket line writes inet:8891@localhost. milter_default_action = accept lets mail go out unsigned if OpenDKIM is down; the default, tempfail, holds it.
• Exim signs in the SMTP transport with dkim_domain, dkim_selector and dkim_private_key (Exim’s specification).
• Check it: opendkim-testkey -d domain -s selector -k keyfile -vvv compares the published record with the private key file ([opendkim-testkey(8)](http://www.opendkim.org/opendkim-testkey.8.html)).

Rotating keys

1. Make a key under a new selector (for example mail2) and publish its record next to the old one.
2. Wait until the new record is visible everywhere (at least the old record’s TTL), then switch the mail server to the new key.
3. Keep the old record for a few days, so messages signed with it can still be checked on arrival.
4. Retire the old selector by publishing it with an empty p=, which marks the key as revoked (RFC 6376 §3.6.1), or delete it.

Limitations

• Ed25519 keys need a browser whose Web Crypto API supports Ed25519; otherwise choose RSA.
• Keys exist only on this page: if you close it before saving the private key, make a new one.
• Passphrase-protected private keys cannot be read here; remove the passphrase on your server first (a mail server needs the key without one).
• This page does not change your DNS or your mail server: you add the record and the settings yourself.

Privacy

On this device: nothing is sent

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.