DKIM Generator

Create RSA keys for email authentication — generated in your browser, verified against live DNS.

Generate your key pair

Domain

Selector

Key size

1024Legacy, phasing out 2048Recommended 4096Slow, DNS limits

After adding the TXT record, check that it's live and matches this key.

2048-bit is the sweet spot — 1024 is being phased out, 4096 is slow and can exceed DNS UDP packet limits.
Use date-based selectors (e.g. zb202610) so key rotation is just a new selector.
The private key goes on your mail server / signing service. It never leaves this page.
DNS can take minutes to hours to propagate — verify again later if the record isn't found yet.
DKIM alone isn't enough — pair it with SPF and a DMARC policy of quarantine or reject.

Keys are generated with your browser's WebCrypto API. Nothing is uploaded or stored.