Skip to content
Mailwel
Email toolsAll email tools
Test and analyze
Decode and encode
DNS and authentication
Servers and reputation
Network toolsAll network tools
IPv4
IPv6
IPv4 and IPv6
Lookups
Bandwidth
Time toolsAll time tools
Converters
Time zones
Calculators
Theme

DKIM key generator

Create a DKIM key pair and its DNS record. Keys are made in your browser and never leave it.

Try:

How it works

DKIM (DomainKeys Identified Mail) lets receivers check that an email really comes from your domain and wasn't changed on the way. Your mail server signs each message with a private key. Receivers fetch the matching public key from your DNS and check the signature.

This page makes both keys in your browser, with the Web Crypto API. Nothing is sent to our server, so only you ever see the private key. Put the private key in your mail server or email provider's DKIM settings, and publish the DNS record we show.

The record goes at selector._domainkey.yourdomain. The selector is any short name you choose, such as s2026. A new selector for each key lets you switch keys later without breaking mail that's already on its way.

RSA with 2048 bits works with every receiver. Ed25519 keys are much shorter, but not every receiver checks them yet, so sign with both if you use one. Once the record is live, send a message to the test inbox to check the signature.