What the DKIM generator is for
DKIM lets receiving mail servers check that a message really comes from your domain and wasn't changed on the way. It needs a key pair: the private key signs your outgoing mail, and the public key is published in DNS as a TXT record. This generator creates both in your browser. Enter your domain and a selector, choose the key size, and you get the exact DNS name and record value to paste, a version for BIND zone files, and the private key for your mail server. Most email services make the key for you; use this when you run your own mail server.
Frequently asked questions
Where do I put the private key?
In your mail server's DKIM settings, for example OpenDKIM, Postfix, Exim or your control panel. Hosted email services such as Google Workspace or Microsoft 365 make their own key; for them, use the record they give you instead.
My DNS panel says the record is too long. What now?
Some panels need the value split into quoted pieces of up to 255 characters, as in the BIND version. Others accept the long value as it is. If yours can't, create a 1024-bit key, but prefer a provider that supports 2048 bits.
How often should I change the DKIM key?
Many guides suggest every 6 to 12 months. Publish the new key under a new selector, switch your server to it, and remove the old record a few days later.