Generate a fresh DKIM key pair for your domain and get the exact TXT record to publish in DNS, free. Your private key is made for this request and is never stored here.
Loading tool…
Lower stack cost. Back in the inbox. Built to send at any scale.
We rebuild it properly: secondary domains, inboxes, SPF, DKIM and DMARC set to enforcement, warmup and safe sending limits, blacklist monitoring on top. Send-ready in about 17 days. No campaigns, no copy, no lead lists. Infrastructure only.
Almost a decade building cold outreach infrastructure, including his own sending and verification stack built from scratch. 20+ B2B clients at companies worth $10M and above, all in tier one countries.
Free · Written plan + fixed price · No sales call required
DKIM, short for DomainKeys Identified Mail, lets a receiving mail server check that an email really came from your domain and was not changed on the way. Your sending platform signs each outgoing message with a private key. The matching public key sits in a DNS TXT record on your domain. When mail arrives, the receiver reads the signature, looks up the public key, and checks the two match.
That signature matters because it ties the message to your domain, not just to a sending IP address. SPF checks the path the mail took. DKIM checks the message itself, and the result can survive forwarding. Together with DMARC, DKIM gives inbox providers a clear reason to trust mail that carries your domain.
A single TXT string in DNS cannot be longer than 255 characters, and a 2048 bit record is longer than that. Most DNS panels accept the full string and split it into parts for you, and the tool shows the record in 255 character parts so you can check. Never add spaces or line breaks inside a part.
The selector is the name before ._domainkey in the host. It lets one domain hold many DKIM keys at once. Each sending service usually gets its own selector, so its key can be changed without touching the others. The selector name itself is not secret, and it can be a simple word like cmk1, google or s1.
Rotation means swapping an old key for a new one from time to time, or at once if a private key may have leaked. Generate a new pair under a new selector, add the new record, point your sender at the new private key, wait until the old record is no longer needed, then remove the old record. Changing selectors this way means mail keeps flowing while you switch.
Give DNS time to update, then run the DKIM Checker with your domain and selector to read the live record and confirm the public key is found. If you send through Google Workspace, the DKIM Checker for Google Workspace walks that setup. For the full picture across SPF, DKIM and DMARC, run the Domain Health Checker.
DKIM proves a message was signed by your domain. It does not say whether the mail is welcome, and it does not stop a stranger from registering a lookalike domain or from spoofing your domain in mail that simply fails the check. Stopping spoofing is the job of DMARC, which tells receivers what to do with mail that fails. Check yours with the DMARC Checker. DKIM also does not fix a weak sender reputation, bad list quality or missing SPF. You need SPF, DKIM and DMARC together, plus mail people want.
Pick 2048 bit unless your sending platform asks for 1024 bit. A 2048 bit key is the current standard and every major receiver accepts it. A 1024 bit key is weaker and some receivers treat it as a bad sign, so use it only when a platform cannot take the longer key.
The private key goes into the sending platform that sends your mail, in its DKIM or domain authentication settings. Some platforms ask you to paste the full PEM block, starting with BEGIN PRIVATE KEY. Never put the private key in DNS. Only the public key, inside the TXT record, goes in DNS.
Once the record is published and your sender is signing, most receivers see the record within a few hours. DNS can take up to 24 to 48 hours to spread everywhere. Send yourself a test message after a few hours and check the result with the DKIM Checker.
A selector is the name in front of ._domainkey in the DNS host. It points to one specific DKIM key, so a domain can run several keys at once for different senders. Receivers read the selector from the message signature and look up that exact record.
Yes. You can have many DKIM records at once, as long as each one uses a different selector. Two records with the same selector on the same domain would clash, so give each sender or each new key its own selector name.
It can help. A valid DKIM signature lets receivers tie your mail to your domain and build trust in it, and DMARC needs DKIM or SPF to pass. DKIM alone does not guarantee the inbox. Reputation, content and list quality still decide placement, but missing or broken DKIM is a common and fixable cause of authentication failures.
Publish the record, wait for DNS to update, then use the DKIM Checker with your domain and selector to confirm the public key is live. Then send a real message from your platform and check that the message shows a DKIM pass for your domain.
No. Your key pair is generated fresh for your request and shown to you once. This site does not store, log or keep your private key. If you lose it, generate a new pair under a new selector and replace the record.
Yes. This generator is free and needs no sign up.
It covers what is broken, what we would build, the timeline, and one fixed price. Want it walked through instead? Book a 15 minute plan walkthrough.
Or just reply to the plan email. Either works.
