--- title: "DKIM record generator" description: "Make a 2048-bit DKIM key in your browser: the TXT record for your DNS and the private key for your mail server. The key is never sent to us. Free, no sign-up." canonical: https://www.acquisity.ai/tools/dkim-record-generator --- # DKIM record generator > Make a 2048-bit DKIM key in your browser: the TXT record for your DNS and the private key for your mail server. The key is never sent to us. Free, no sign-up. Type your domain and a name for the key. Your browser makes the key pair, and you get the DNS record to publish and the private key for your mail server. Use the tool in a browser at [/tools/dkim-record-generator](https://www.acquisity.ai/tools/dkim-record-generator). It is free and needs no sign-up. ## What a DKIM record is DKIM lets an inbox check that an email really came from your domain and wasn’t changed on the way. Your mail server signs each email with a private key. The matching public key sits in your DNS, in a [TXT record](https://www.acquisity.ai/tools/txt-record-lookup) at selector._domainkey.yourdomain.com, and the inbox uses it to check the signature. The record is short apart from the key itself: v=DKIM1 says it’s a DKIM key, k=rsa names the kind of key, and p= holds the public key. ## Do you need to make your own key? Usually not. Google Workspace and Microsoft 365 make the key for you in their admin settings and give you the records to add, and most email services do the same. Their key is the one their servers sign with, so a key you make yourself wouldn’t help there. Make your own when you run your own mail server (for example Postfix with OpenDKIM or Rspamd), or when a service asks you to bring your own key. ## How this generator works - Your browser makes an RSA key pair with its built-in Web Crypto API. The key is never sent to us or anyone else. - The public key goes in the record as p=, in the format inboxes read. - The private key is shown once, as a PEM file for your mail server. Nobody keeps a copy, so save it before you close the page. - Keys are 2048 bits unless you choose 1024, the smallest size the standard allows. ## Choosing a selector The selector is the name the key lives under. Any one word of letters, numbers or dashes works, such as mail or a date like 2026oct. Your mail server puts it in every signature (s=), so inboxes know which key to look up. Give each new key a new selector. Then the old key keeps working for email already on its way while the new one takes over. ## Questions ### What is a DKIM selector? The name a DKIM key is stored under. The record lives at selector._domainkey.yourdomain.com, and each signature names its selector, so one domain can have several keys at once, for example one per service. ### Should my DKIM key be 1024 or 2048 bits? 2048. The current standard (RFC 8301) says signers should use keys of at least 2048 bits and must not use keys under 1024. Choose 1024 only if your DNS provider can’t hold the longer record. ### Can I make an ed25519 or 4096-bit DKIM key here? No, on purpose. Ed25519 keys (RFC 8463) are short, but Gmail, Outlook and Yahoo don’t check ed25519 signatures yet, so email signed only with one fails DKIM there. A 4096-bit RSA key works, but its record is about 750 characters in three pieces, which some DNS providers’ forms don’t handle well, and 2048 bits already meets the standard. ### Is it safe to make a DKIM key in a browser? Yes, here. The key is made by the cryptography built into your browser, and it never leaves the page: open your browser’s network tab and you’ll see nothing is sent when you make it. Keep the private key somewhere safe, because anyone who has it can sign email as your domain. ### My DNS provider says the DKIM record is too long. What do I do? A single piece of a TXT record holds at most 255 characters, and a 2048-bit record is longer. Many DNS providers, such as Cloudflare, split it for you. If yours doesn’t, paste the record as quoted pieces, which the generator gives you under "If your DNS provider wants it in pieces". Inboxes join the pieces back together. ### How do I change my DKIM key? Make a new key under a new selector, publish its record and switch your mail server to it. After a few days, when no email signed with the old key is still on its way, delete the old record. ### How long until a new DKIM record works? Usually a few minutes, but DNS changes can take up to 48 hours to reach everyone. Check your domain with the [SPF checker](https://www.acquisity.ai/tools/spf-checker) after you save, and if your selector isn’t mail, enter it under More options. Then send yourself an email and look for dkim=pass in the original message. ## Sending cold email? Keep it off your main domain. Acquisity sends cold email from separate domains, with SPF, DKIM and DMARC set up for you. [Cold Email Agent](https://www.acquisity.ai/agents/cold-email). --- Web page: https://www.acquisity.ai/tools/dkim-record-generator Site index for agents: https://www.acquisity.ai/llms.txt