What does a DKIM TXT record look like?

A semicolon-separated tag list published at selector._domainkey.yourdomain, typically v=DKIM1; k=rsa; p= followed by the base64 public key. The h= tag pins the hash algorithm and t= carries flags.

What is a DKIM selector?

A label that names one key, forming the first part of the record name. Using different selectors lets you publish a new key and switch signing over to it before retiring the old record, so rotation never interrupts delivery.

Should DKIM keys be 1024 or 2048 bits?

2048 bits. It has been the practical standard for years, and several large receivers now treat 1024-bit keys as weak. The only reason 1024 persists is DNS providers that could not handle long TXT values.

Can I publish more than one DKIM record?

Yes, one per selector. That is how rotation works, and how a domain can sign with both an RSA and an Ed25519 key while receiver support for the latter is still uneven.

Is my key uploaded when I use this generator?

No. The record is assembled in your browser, so the key you paste stays on your device. Even so, only ever paste the public half — the private key belongs on the signing server.

DKIM Record Generator

Build the DKIM TXT record for a selector and public key, or paste an existing one to check its tags.

The DKIM Record Generator runs entirely in your browser. Selectors, domains and keys you paste are processed on your device and never uploaded.

Open the DMARC Record Generator

About DKIM Record Generator

DKIM publishes the public half of a mail signing key in DNS, at a name built from a selector and your domain. The record itself is a short tag list — a version, a key type and the base64 body of the public key — but the details trip people up: the p= value is the SubjectPublicKeyInfo body from a PEM file with the armour stripped, a 2048-bit key runs well past the 255-character limit for a single DNS string, and a stray t=y flag tells receivers to ignore failures. This tool assembles the record from a key you paste, splits it the way a zone file needs, and parses an existing record so you can see what is actually published.

Features

Builds the record name from selector and domain automatically
Accepts a PEM block or bare base64 and strips the armour for you
RSA and Ed25519 key types, with the key size estimated from the key itself
Optional testing, subdomain and service-type flags
Splits long records into 255-character quoted strings for a zone file
BIND-ready zone line alongside the single-line value
Inspect mode parses an existing record and flags missing or wrong tags
Warns loudly if you paste a private key by mistake

How to use the DKIM Record Generator

Enter the selector your mail server signs with, and your domain
Paste the public key — the PEM block or just its base64 body
Copy the host name and the record value into your DNS provider
Use inspect mode later to confirm what is actually published

Example

Input

selector: mail   domain: example.com

Output

mail._domainkey.example.com  TXT
v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0B...

The record name is always selector._domainkey.domain — the selector lets you rotate keys without a gap in signing.

Common errors & troubleshooting

The DNS provider rejects the record as too long. — A 2048-bit key exceeds the 255-character limit for one DNS string. Use the split version shown here, which quotes each chunk separately; most providers join them back together automatically.
Signatures fail verification even though the record exists. — Check the selector matches what your mail server puts in the DKIM-Signature header, and that the p= value has no line breaks or spaces left in it from copying out of a PEM file.
Receivers ignore DKIM failures entirely. — You probably have t=y set, which marks the domain as testing. Remove the flag once you are confident signing works.

Frequently asked questions

What does a DKIM TXT record look like?: A semicolon-separated tag list published at selector._domainkey.yourdomain, typically v=DKIM1; k=rsa; p= followed by the base64 public key. The h= tag pins the hash algorithm and t= carries flags.
What is a DKIM selector?: A label that names one key, forming the first part of the record name. Using different selectors lets you publish a new key and switch signing over to it before retiring the old record, so rotation never interrupts delivery.
Should DKIM keys be 1024 or 2048 bits?: 2048 bits. It has been the practical standard for years, and several large receivers now treat 1024-bit keys as weak. The only reason 1024 persists is DNS providers that could not handle long TXT values.
Can I publish more than one DKIM record?: Yes, one per selector. That is how rotation works, and how a domain can sign with both an RSA and an Ed25519 key while receiver support for the latter is still uneven.
Is my key uploaded when I use this generator?: No. The record is assembled in your browser, so the key you paste stays on your device. Even so, only ever paste the public half — the private key belongs on the signing server.

Related tools

SPF Record Generator — Build and validate the SPF TXT record that stops others sending mail as your domain.
DMARC Record Generator — Build and validate a DMARC DNS TXT record with policy, reporting and alignment.
Reverse DNS Generator — Turn IPs and prefixes into PTR names, zone files and RFC 2317 delegations.
SSH Key Generator — Generate Ed25519, RSA or ECDSA SSH keypairs in your browser and download the public and private keys.
X.509 Certificate Decoder — Decode a PEM or DER certificate to view subject, issuer, validity, SANs and fingerprints.
Certificate & Private Key Matcher — Confirm an X.509 certificate or CSR and a private key belong together (the classic modulus mismatch check) — locally in your browser.