Skip to content
Coupons 8

You have not saved any offers or providers yet. Tap the bookmark on an offer or choose Save on a provider profile.

    Monitoring free
    Monitor your website for free
    Coupons 8 Login
    Free tool

    DKIM Generator: create your DKIM key and DNS record

    Generate a DKIM key pair right in your browser, or turn an existing public key into a ready-made DKIM record for your DNS.

    Create your DKIM record

    Choose whether you need a new key pair or already have a public key from your mail server.

    Using Google Workspace, Microsoft 365 or another mail provider? Then the provider generates the DKIM key itself and shows you the DNS record in its admin area. The same goes for server panels such as Plesk, cPanel, KeyHelp, ISPConfig or DirectAdmin: you enable DKIM in the domain's mail settings, and the panel creates the key and usually the DNS record as well. You only need your own key for a mail server you set up yourself, such as Postfix with OpenDKIM or Rspamd.

    What would you like to do?

    A name of your choice for the key, for example with a date. That way you can introduce a new key later without deleting the old one straight away.

    Your DNS record

    Type
    TXT
    Host / name
    selector._domainkey
    Value
    –
      Once it's live: run the DKIM check

      No guarantee for the result. Once published, check that selector and key match your mail server. Changes to your DNS and mail server are at your own risk.

      The key is created with the Web Crypto API in your browser. Neither the private nor the public key is transmitted to or stored by hosttest.

      What is a DKIM record?

      DKIM in one sentence

      With DKIM (DomainKeys Identified Mail), your mail server signs every outgoing message with a private key. You publish the matching public key as a TXT record at selector._domainkey.your-domain.com. The receiver fetches it via DNS and uses it to verify that the message really comes from you and wasn't altered on the way.

      DKIM: the sender signs, the receiver verifies with the key from DNS Sending server signs with private key DKIM-Signature: s=mail Receiver verifies the signature DKIM valid ✓ DNS mail._domainkey.example.co.uk v=DKIM1; k=rsa; p=MIIBIjAN… Email with signature public key
      DKIM: the sender signs, the receiver verifies with the key from DNS

      Selectors: several keys per domain

      The selector is the part before ._domainkey. It appears in the s= field of the DKIM signature in every signed message, so the receiver knows which key to look up. Each service that sends mail for you uses its own selector – Google uses google, for example, and Microsoft selector1 and selector2.

      Why DKIM complements SPF

      SPF checks the server, DKIM checks the message itself. When a message is forwarded, SPF often fails because the forwarding server isn't in your SPF record. The DKIM signature travels with the message and stays valid as long as nobody changes the content. That makes DKIM the more robust of the two checks for DMARC.

      How to set up DKIM on your mail server

      1. Generate a key pair

        Generate a 2048-bit key pair above and pick a selector. Alternatively, let your mail server create the pair, e.g. with opendkim-genkey or rspamadm dkim_keygen, and only paste the public key here.

      2. Install the private key

        Download the private key and add it, together with domain and selector, to your mail server's DKIM configuration (OpenDKIM, Rspamd, Mailcow …).

      3. Create the TXT record

        In your DNS settings, create a TXT record with the host selector._domainkey and paste the value. Most DNS panels split long values automatically.

      4. Check it

        Check the record with the DKIM check and send a test message to a Gmail mailbox. Under “Show original”, DKIM should say PASS.

      The tags in a DKIM record

      The DNS record only contains a few tags. The actual signature, with selector and hash, sits in the header of every message.

      Tag Meaning Example
      v Version. Optional, but if present it comes first. v=DKIM1
      k Key type. rsa is the default and supported everywhere; ed25519 isn't supported by every receiver yet. k=rsa
      p The public key in Base64. An empty p= revokes the key. p=MIIBIjANBgkqh…
      t Flags: t=y marks test mode, t=s forbids subdomains in the signing domain. t=s
      h Permitted hash algorithms. If omitted, all are allowed; sha256 is standard today. h=sha256

      Frequently asked questions

      How do I create a DKIM record?

      If you use a mail provider, enable DKIM in its admin area and copy the record it shows you. If you run your own mail server, generate a key pair above, install the private key on the server and publish the public key as a TXT record at selector._domainkey.

      Is it safe to generate the key here?

      The key is created with your browser's Web Crypto API, so on your own device. It's neither transmitted to us nor stored. If you want to be completely sure, generate the pair directly on your mail server and only use the existing-key option here.

      1024 or 2048 bits?

      2048 bits. 1024-bit keys are considered weak and some checkers flag them. 4096 bits adds little security but no longer fits into a single record at many DNS providers.

      Which selector should I choose?

      The name is up to you. A date such as s202611 works well, as you can see at a glance how old a key is. What matters is that the mail server and the DNS record use the same selector.

      How often should I rotate the DKIM key?

      Every six to twelve months is the usual recommendation. Generate a new pair with a new selector, publish the public key in DNS and switch the mail server over. Only delete the old record after a few days, once no more mail with the old signature is in transit.

      Why does DKIM fail even though the record exists?

      Common reasons: the selector in DNS doesn't match the signature, the value was cut off or picked up spaces when copying, or a service modifies the message after signing, for example by appending a footer. The DKIM check shows you whether the record is publicly reachable and the key is valid.

      More free tools

      Check domains and websites with our free tools – quickly and without signing up.

      Availability

      Website Status Checker

      Check whether a website is online, how quickly it responds and how long its SSL certificate remains valid.

      Open tool       Infrastructure

      WHOIS & hosting check

      Identify a domain's hosting provider, IP address, nameservers and likely server location.

      Open tool       DNS & email

      DNS check

      Check every DNS record of a domain – with MX, SPF, DMARC, CNAME and nameserver checks.

      Open tool       Continuous monitoring

      Website monitoring

      Monitor websites and servers around the clock and receive immediate alerts by email, SMS or phone call when something goes down.

      Open tool       Domain

      Domain checker

      Check suitable domain names and find out which extensions are available for your project.

      Open tool       Hosting selection

      Web hosting advisor

      Answer a few questions about your website, application and requirements to find suitable plans from our hosting comparison.

      Open tool       Personal service

      Hosting tender

      Describe your project and receive non-binding, individually matched offers directly from hosting providers.

      Start tender