DKIM

DKIM (RFC 6376) lets receiving servers verify that a message was really signed by your domain. The public key is published as a TXT record at <selector>._domainkey.<domain>; this generator creates a fresh RSA-2048 or Ed25519 key pair directly in your browser, or builds the record from an existing public key.

Keep the private key safe. Key pairs are generated locally with the Web Crypto API; the private key is shown once, is never transmitted anywhere and is gone when you reload the page. Move it into your mail server's DKIM signing configuration before leaving this page.

Record values longer than 255 characters are split into several quoted strings ("part1" "part2") as the TXT format requires – many DNS provider interfaces do this splitting automatically when you paste one long value. To revoke a published key later, keep the record but publish it with an empty p= value. Dual signing with RSA and Ed25519 (RFC 8463) requires two separate selectors.

Domain

Selector

A DNS label (letters, digits, hyphens). Date-based selectors such as 202607 make key rotation easier.

Key

Generate an RSA-2048 key pair (recommended default)

Generate an Ed25519 key pair (RFC 8463)

Use an existing public key (paste below)

Ed25519 needs a current browser (Chrome 137+, Firefox 129+, Safari 17+); the option is disabled if your browser lacks support.

Existing public key (only for “paste”)

PEM (SubjectPublicKeyInfo) or the bare Base64 value.

t=s – strict mode: the signing identity (i=) must not be a subdomain of d=

Runs entirely in your browser. Record Studio · Verify the result with the domain security check