Free DKIM record generator

Free DKIM record generator for selector-based email signing

Use this free DKIM record generator to create an RSA key pair, generate a DNS-ready DKIM TXT record, and export PEM keys for selector-based signing. It is built for teams setting up a new sender, rotating selectors, or replacing hand-built DKIM records before the next release.

Generate a free DKIM record

Create a selector, TXT record, and PEM key pair

Enter the domain, choose a selector, and pick the RSA key size. Generation runs in the browser and returns the DNS record plus both PEM exports.

Best fit

Use this when a selector needs to be created or rotated cleanly

This page is strongest when a team is preparing a new sender, migrating providers, or formalizing a DKIM rotation process instead of hand-copying key material across DNS and ESP settings.

Create a new selector before sender cutover
Replace brittle hand-managed DKIM records
Keep rotation work documented and repeatable

Rollout note

Generation is only the first half of DKIM success

A generated selector record is useful only when the signer and DNS state stay aligned. Publish the TXT value, configure the signer with the matching private key, then validate the live selector and real header verdicts.

Publish only the public TXT value in DNS
Store the private key in your sender platform
Validate the live selector after propagation

Open DKIM checker

Key details

Primary use

DKIM setup

Generate selector material before onboarding a new ESP, sender service, or signing domain.

Output

TXT + PEM

Get the DNS record plus private and public key material for your signing workflow.

Privacy

Browser-side

Key generation runs in the browser session so private material is not posted to the API.

Best moment

Rotation ready

Use it when you need clean selector changes without waiting for incident pressure.

What this generator does

A useful DKIM generator gives you deployable output, not just a placeholder string

Searchers need the exact selector hostname, a DNS-ready TXT value, and usable key material. This page creates the full starting package so implementation work can move into DNS and sender configuration immediately.

Selector host

DNS-ready

Build the exact selector hostname in the form selector._domainkey.example.com.

TXT value

DKIM1 + RSA

Generate the public key material for DNS in the format mailbox providers expect.

Private key

PEM export

Use the private PEM in the signing platform that will stamp outbound mail.

Rotation

Versioned selectors

Create a new selector like s2 or 2026q1 before decommissioning the prior key.

Operational use

Most teams need DKIM generation during setup, migration, or planned rotation

Treat DKIM generation as controlled change work. Create the selector, publish the TXT value, update the signing platform, confirm propagation, and verify real messages show the selector and dkim=pass.

New sender onboarding

Create a clean selector before adding a new ESP or outbound provider so DNS and signer configuration stay aligned from day one.

Provider migration

Stage the next selector before cutover so the old sender can be retired without ambiguous overlapping key use.

Planned rotation

Keep a predictable selector rotation cadence so key retirement is a routine change instead of a rushed remediation project.

Related tools

DKIM checker

Validate the live selector after publishing DNS and confirm the record is readable and healthy.

Open tool

DNS propagation checker

Confirm the new TXT record has propagated before you trust the signer rollout.

Open tool

Email auth checker

Review DKIM alongside SPF, DMARC, BIMI, MX, MTA-STS, and TLS-RPT in one pass.

Open tool

Email header analyzer

Inspect real headers after rollout and confirm Authentication-Results shows dkim=pass.

Open tool

FAQ

Does this DKIM record generator create a real key pair?

Yes. This page generates an RSA key pair in the browser, returns a DKIM TXT record for DNS, and gives you PEM outputs for the private and public key materials.

Is the private key uploaded anywhere?

No. Generation happens in the browser session so the private key is not sent to MailSlurp from this page. Store it securely after generation and rotate it on a predictable cadence.

Should I use 1024-bit or 2048-bit DKIM keys?

Use 2048-bit DKIM keys unless a legacy provider still requires 1024-bit support. The larger key is a better default for modern sender-auth posture.

What should I do after generating a DKIM record?

Publish the TXT record in DNS, configure the sending platform to sign with the matching selector and private key, then validate the live record and confirm real messages show dkim=pass in Authentication-Results.