[ Free tool · Generators ]
DKIM Record Generator
Generate a DKIM key pair and the TXT record to publish, in your browser.
Domain
Selector
Key size
2048-bit is the recommended default; some DNS hosts can't hold 4096-bit keys.
[ About this tool ]
This DKIM generator creates an RSA key pair and the matching DNS TXT record locally using your browser's Web Crypto API.
How to read the results
- ›Publish the public key at <selector>._domainkey.<domain>.
- ›Install the private key only on your signing server.
- ›2048-bit keys may need to be split into multiple strings.
Frequently asked questions
Is the private key sent anywhere?
No. Keys are generated on your device and never leave the browser.
Learn more in our guide: DKIM (DomainKeys Identified Mail)
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption
[ More tools ]
DKIM Lookup
Verify a DKIM selector is published and the key is valid.
Full Domain Health Scan
Run every email security check at once and get one score.
DMARC Checker
Look up and explain any domain's live DMARC record.
SPF Checker
Validate your SPF record and check the 10-lookup limit.
BIMI Record Checker
Check a BIMI record and whether the logo will actually display.
MTA-STS & TLS-RPT Checker
Check your TLS policy record, policy file and TLS reporting.