Generate a DKIM Key Pair in 60 Seconds

Generate your key pair

Pick a selector, generate the key pair locally, and copy the record into your DNS. The private key goes into your mail provider's DKIM signing settings — not into DNS.

Record ready? Have a specialist double-check it — the $49 Email Domain Trust Audit is a fixed-output report with risk notes and prioritized next steps.

After you publish

1. Publish the TXT record at selector._domainkey.yourdomain (for example s1._domainkey.example.com) — not at the domain root. If your DNS editor caps a single string at 255 characters, use the chunked quoted form the generator shows; both publish the identical record.
2. Install the private key at your mail provider — Google Workspace, Microsoft 365, SendGrid, Postmark and the rest all have a DKIM signing page that takes the private key and the selector. This is the step people miss: the DNS record alone signs nothing.
3. Send a test and verify — DKIM signatures only count once the private key signs real mail. Run the free domain trust check to confirm DKIM passes alongside SPF and DMARC:

• Run the Free Email Domain Trust Checker
• Rotating DKIM keys with selectors, no downtime
• DMARC alignment, explained

4. Verify the record itself — once DNS propagates, run the Free DKIM Record Checker to confirm the v=DKIM1 record parses cleanly, the public key decodes, and the selector resolves.

Complete the authentication set

Email authentication needs all three records working together. Generate the rest of the set, free, in your browser:

• Free SPF Record Generator

• Free DMARC Record Generator

• Free BIMI Record Generator

• Free MTA-STS Record Generator

Prefer done-for-you?

If you'd rather hand this to a specialist, submit your domain for the Email Domain Trust Audit — a fixed-output report with risk notes and prioritized next steps. When records are broken and you want them fixed, the 99 Mailbox Rescue gets them fixed within 48 hours, zero tech touch.

Frequently asked questions

What does a DKIM record do? DKIM adds a cryptographic signature to your mail headers that receiving servers verify against the public key in your DNS. A passing DKIM signature proves the message came from your domain and was not altered in transit.

Where do I publish the DKIM record? Publish it as a DNS TXT record at selector._domainkey.yourdomain (for example s1._domainkey.example.com), not at the domain root. DNS changes can take minutes to hours to propagate.

What do I do with the private key? Keep it secret and paste it into your mail provider's DKIM signing settings — Google Workspace, Microsoft 365, SendGrid, Postmark and the rest each have one. The DNS record alone signs nothing; your provider uses the private key to sign every outgoing message. Never publish the private key in DNS.

Should I use a 2048-bit or 1024-bit key? Use 2048-bit. 1024-bit DKIM keys are a legacy size and several receivers now flag or distrust short keys. 2048-bit is the current safe default and fits in a single DNS TXT record.

Do my keys ever leave my browser? No. The key pair is generated with WebCrypto on your own device and is never sent to Veldica or anywhere else. Your private key only exists in this tab until you copy it.