dotvitals

DKIM Record Generator

Turn a DKIM public key and selector into a correctly formatted DNS TXT record.

Give the domain in the From address, not the selector's full record name — we add the `<selector>._domainkey` part ourselves. A signature only counts for DMARC when the key is published under the domain the message says it is from.

About the dkim record generator

Once a mail platform generates a DKIM key pair, publishing the public half correctly in DNS is a matter of exact formatting: the record must sit at selector._domainkey.yourdomain.com, use the p= tag for the key, and be syntactically valid TXT record content, which is easy to get wrong by hand when copying a long base64-encoded key. This generator takes the selector name and the public key your mail platform or signing tool provided, and assembles the correctly formatted record, including the v=DKIM1 version tag and, where relevant, a k= tag naming the key algorithm.

Longer keys, particularly 2048-bit RSA keys, often exceed the 255-character limit a single DNS string can hold. Many DNS hosts require these to be split into multiple quoted strings within one TXT record; the generator handles that splitting automatically so the record is valid regardless of your provider's input format. It also flags the difference between generating a new key, which requires updating the record and coordinating with your sending platform, and simply re-publishing an existing key that was lost from DNS, which only requires republishing the same value your mail platform already has on file.

Testing the published record with a DKIM checker afterward is worth doing before considering the rollout complete, since a formatting mistake introduced while pasting a long key into a DNS panel is common and otherwise only surfaces once real mail starts failing signature verification. That small verification step, run once right after publishing, catches the single most common DKIM rollout mistake before it has a chance to affect a single piece of real outbound mail.

Common questions

Do I need to generate the key here?
No, this tool formats a DNS record from a public key your mail platform or signing tool already generated; the private key never needs to leave that platform.
Why is my key split into multiple quoted strings?
DNS TXT record strings are limited to 255 characters each. A 2048-bit RSA key is longer than that, so many hosts require it to be split across multiple quoted strings within one record.
What does the k= tag mean?
It names the key algorithm, most commonly rsa. It is optional in most implementations but including it explicitly avoids ambiguity for validators that check for it.
What if I change signing providers?
Publish a new selector with the new provider's key rather than overwriting the old one immediately, so mail already in transit signed with the old key continues to validate during the transition.