DKIM Record Generator

1. Pick a selector (any short label like s1) and generate the keypair.
2. Publish the public record as a TXT record at <selector>._domainkey on your domain.
3. Install the private key on the server or service that sends your mail, configured to sign with the same selector.
4. Send a test message and confirm DKIM passes (most providers showdkim=pass in the message headers).

Use 2048-bitunless something you’re integrating with genuinely can’t handle it. 1024-bit keys still work but are increasingly treated as weak, and some receivers discount them. The only real cost of 2048 is that the public key no longer fits in a single 255-character DNS string — which your DNS host splits for you automatically.

The private key is what proves a message is really from you — anyone who has it can sign mail as your domain. It’s generated entirely in your browser and never transmitted, but once you copy it, store it like any other secret: in your mail server’s key store or a secrets manager, never in a repo. To rotate, generate a new key under a new selector, publish it, switch signing over, then remove the old record.

DKIM proves a message wasn’t tampered with; SPF says which servers may send for you; and DMARC ties them together and tells receivers what to do on failure. You want all three.