DKIM Record Generator & Checker

All tools

Turn the public key from your mail server into a selector._domainkey TXT record, and check the DKIM key a domain publishes today.

Paste the public key your mail server produced to build the record to publish, or switch to the checker to inspect the DKIM key a domain uses today. Private keys stay on your server — never paste one here.

Key details
The name your mail server uses to publish this key — it appears in the signature as s=.
Paste the public key your mail server produced. PEM headers, line breaks and a leading p= are stripped automatically.
Options
Leave on any unless you must forbid SHA-1.
Tells receivers to ignore signature failures. Remove it once DKIM works.
Forbids using this key for subdomains of the signing domain.
Your DKIM record
Record type
TXT
Name / host
—
TTL
3600
Publishing it
  1. Generate the key pair on your mail server, or open your provider's DKIM settings.
  2. Copy the public key and the selector it was issued under.
  3. Add a TXT record with the name and value shown here.
  4. Turn on DKIM signing on the mail server once the record has propagated.
  5. Send yourself a test message and confirm the key with the checker tab.

A 2048-bit key makes the record longer than 255 characters. That is fine: DNS stores it as several quoted strings, and most control panels split it for you.

Leave empty to probe the common selectors instead.
Published record
Published key
Key
—
Record looked up
—
Selector discovery

SelectorKey
Record tags explained
TagValueWhat it means
What we found

About DKIM Record Generator & Checker

The DKIM Record Generator & Checker builds the `selector._domainkey` TXT record you publish, and inspects the one a domain publishes today. DKIM signs each outgoing message with a private key held on your mail server; receivers fetch the matching public key from DNS and verify the signature. Get the record wrong and every signature fails silently.

The generator takes the public key your mail server or provider produced and wraps it with the right tags: the version, the key type, the optional hash restriction, the service type and the flags. It never asks for, generates or transmits a private key — that key is created on the server and must never leave it, which is why no honest DKIM tool will offer to make one for you in a browser.

The checker looks up the selector, validates every tag against RFC 6376 and derives the key algorithm and size from the published key. It flags the problems that matter: a revoked key (an empty `p=`), a key that was truncated when it was copied, a 1024-bit key that should be replaced, testing mode left switched on — which tells receivers to ignore failures entirely — and a `h=sha1` restriction that RFC 8301 deprecated. If you do not know your selector, leave the field empty and it probes the common ones.

How to use DKIM Record Generator & Checker

  1. Generate the key pair on your mail server, or open the DKIM settings of your email provider.
  2. Copy the public key and the selector it was issued under. Leave the private key where it is.
  3. Paste the public key into the Generator tab, set your domain and selector, and adjust the options if you need to.
  4. Publish the TXT record at the name shown — selector._domainkey.yourdomain.com — with a TTL of an hour.
  5. Turn on DKIM signing in your mail server once the record has propagated.
  6. Use the Checker tab to confirm the key is readable, the right size, and not left in testing mode.

Frequently asked questions

A short label that lets one domain publish several DKIM keys at once. It appears in the signature as s= and in DNS as selector._domainkey.yourdomain.com. Providers pick their own — Google uses google, others use default, s1 or a date.

Never. The private key signs your mail and must stay on the mail server. This tool only handles the public half, and it does not generate keys — anything that offers to create a DKIM key pair in your browser should be treated with suspicion.

2048-bit RSA is the current recommendation and is accepted everywhere. 1024-bit keys still verify but are the old minimum and some receivers now downgrade them. Below 1024 bits, RFC 8301 requires verifiers to reject the signature outright.

That is normal for a 2048-bit key. DNS stores a long TXT record as several quoted strings of up to 255 characters each, and most control panels split it for you. The record is only invalid if a single string exceeds the limit.

It means the key has been revoked. RFC 6376 requires verifiers to treat every signature from that selector as failed. If that was not intended, republish the public key.

It puts the key in testing mode, telling receivers to treat a failed signature exactly as if the message had not been signed. It is useful while setting DKIM up, and pointless afterwards — remove it once signing works, or DKIM protects nothing.
Share this
Related Tools
SPF Record Generator & Checker Build a valid SPF record from the services that send your mail, then check what your domain publishes against the RFC 7208 rules. Free
DMARC Record Generator & Checker Build a DMARC record with a safe rollout path from monitoring to enforcement, and check the policy a domain publishes today. Free
DNS Lookup Query the live DNS records of any domain — A, AAAA, CNAME, MX, NS, TXT, SOA, SRV and CAA — with TTLs and one-click copy. Free. Free
HTTP Status Codes Look up every HTTP response status code (1xx–5xx) in a searchable, filterable directory — then open any code for what it means, when to use it, whether it is cacheable and the RFC that defines it. In your browser, free. Free
HTTP Methods A scannable reference for every HTTP request method — GET, POST, PUT, PATCH, DELETE and the rest, plus WebDAV — showing at a glance whether each one is safe, idempotent and cacheable, if it takes a body, and a typical example. In your browser, free. Free
HTTP Headers Reference Look up common HTTP request and response headers in a searchable directory — filter by direction and category, read a one-line description and a realistic example, and copy any header name with one click. In your browser, free. Free
Popular searches
dkim record generator dkim checker dkim record check dkim lookup dkim validator dkim selector lookup generate dkim record check dkim key length dkim txt record dkim record example
Need help?
Found an issue with this tool? Let our team know.
Report an issue

Add this free tool to your own website — copy and paste the code below.