How to create a DKIM record

DKIM adds a cryptographic signature to each outgoing email. Receiving systems use the public key in DNS to check that signature. It helps prove that a message was authorized by the signing domain and was not altered after signing.

The free DKIM record generator creates an RSA key pair in your browser and gives you the public DNS value and private PEM separately.

Quick answer

Create a DKIM key pair, choose a selector, publish the public key as a TXT record at selector._domainkey.yourdomain.com, and add the matching private key to your email provider. Then send a test message and inspect the receiving server's headers for a DKIM pass.

Never publish the private key in DNS or share it in a support ticket, document, or spreadsheet.

Choose a selector

A selector is the name that identifies a particular DKIM key. Common choices include a provider name or a date-like rotation label. For example, with the selector mail2026 and domain example.com, the record name is:

mail2026._domainkey.example.com

Selectors let you use more than one key and rotate keys without disrupting existing mail. Use a new selector when rotating rather than replacing a key before your provider is ready to sign with the replacement.

Generate and store the keys

Generate the key pair, then keep the two pieces separate:

• Public key: goes in DNS as the p= value of the DKIM TXT record.
• Private key: goes only into the email service that signs outgoing mail.

2048-bit RSA keys are a common default. Check that both your email provider and DNS provider support the key size you choose, especially when using very long records.

Publish the public key

Your sending provider may give you the exact TXT name and value it expects. If you create the key yourself, the record generally includes v=DKIM1 and the public key:

v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY

Create that value as a TXT record at the selector location. DNS interfaces sometimes split long TXT values into quoted segments. That can be valid if the provider joins the segments into one record, but follow the provider's documentation rather than guessing.

Add the private key to your provider

Import the matching private key into the email provider or mail server that will sign messages. The provider needs the same selector you used in DNS. A public record without active signing will not produce a DKIM pass.

Some providers manage DKIM keys for you and instead provide a DNS record to publish. In that case, use the value they provide rather than creating a parallel key pair.

Verify with a real message

DNS configuration alone is not enough. Send a test message to a mailbox you control, open its raw headers, and look for dkim=pass in Authentication-Results. The email header analyzer can help you read that result.

Also configure SPF and DMARC. DKIM is an important layer, but it is not a complete deliverability configuration on its own.

Frequently asked questions

What is a DKIM selector?

It is the label before ._domainkey that points a message to the correct public key in DNS.

Can I reuse a selector?

Only when the private key and public DNS record still match. Use a new selector for a clean key rotation.

Is the public key secret?

No. The public key belongs in DNS. The private key must remain protected in the sending system.