DKIM key generator

Creates a 2048-bit DKIM key pair in your browser and gives you the DNS record to publish. The private key never leaves your device.

Sending through Google Workspace, Microsoft 365 or a sending tool? Don't generate a key here. They make their own: turn DKIM on in their settings and publish the record they show you.

Published the record? Check the key resolves and its length.

Next: check it with the DKIM checker

DKIM signs the message. SPF says which servers may send it.

Then: build your SPF record

Put Ken on the rest of your outbound

Inboxes, warmup, leads and copy in one place. Ken runs these checks on every inbox it manages.

Start free - 1,000 credits, no card

What the DKIM key generator does

It creates an RSA key pair in your browser with the Web Crypto API and writes the DNS record for the public key. The private key never leaves your device. Nothing is sent to a server, and Ken never sees it.

Choose a selector and a key length. 2048 bits is the default and the length RFC 8301 recommends. You get the private key in PEM format and a TXT record for selector._domainkey.yourdomain.com containing v=DKIM1, k=rsa and p= with the public key.

When you need your own key

Hosted providers make their own keys. In Google Workspace you generate the key in the Admin console under Gmail, Authenticate email. Microsoft 365 hosts the keys itself and asks you to add two CNAME records. Use those flows when you can.

Generate your own key when you run the signing server: Postfix with OpenDKIM, an SMTP relay that asks for your key, or a self-hosted app. The server signs with the private key and DNS holds the public half.

How to install the key

Publish the TXT record first and wait until it resolves. Check it with the DKIM checker.
Load the private key into your server or tool and set the same selector and signing domain.
Send a test message and look for dkim=pass in the Authentication-Results header.
Store the private key like a password. Anyone who has it can sign mail as your domain.

A 2048-bit public key is longer than 255 characters, so it goes in as several strings inside one TXT record. Most DNS panels split it for you.

Why it matters for cold email

If you send from your own SMTP servers, signing with your own domain is what makes DMARC pass. Use a separate selector per server or tool, so one key can be revoked without touching the others.

Rotate keys on a schedule. Publish a new selector, switch signing to it, and leave the old record up for a week or so, so messages still in transit verify. Then empty the old record's p= value to revoke it.

Questions

Is it safe to generate a DKIM key online?

Only if the key is made on your device. This generator runs in your browser with Web Crypto and never uploads the private key. Avoid generators that build the key on their server, because whoever runs that server has seen your key.

Should I use a 1024 or 2048-bit DKIM key?

2048. RFC 8301 sets 1024 as the floor and recommends 2048 for signers. Longer keys such as 4096 are allowed, but the record gets large enough that some DNS hosts struggle to store it.

What selector name should I use?

Any short label of letters, digits and hyphens. A date works well, like s202610, because it shows when the key was made and which one to retire next.

What about Ed25519 DKIM keys?

RFC 8463 defines them, and they're much shorter, but not every receiver verifies them. If you use Ed25519, sign with an RSA key as well, so receivers without support still see a valid signature.

Where does the private key go?

Into the mail server or sending tool that signs your outgoing mail, usually as a PEM file or pasted into a settings field. It never goes in DNS. Only the public key is published.