How does the DKIM generator work?

Enter your selector (e.g. default, s1, google) and domain, choose a key type (RSA 1024/2048/4096 or Ed25519), paste your base64 public key (the p= tag — generated locally by opendkim-genkey or openssl, never uploaded), optionally set hash algorithms (h=), service type (s=), flags (t=y for test mode, t=s for strict selector), and notes (n=). The generator assembles a valid `v=DKIM1; k=rsa; p= ; ...` TXT record for the ` ._domainkey. ` DNS name with tags in the recommended order, and shows a live preview you can copy. Validation against RFC 6376 runs as you type.

What does the validator check?

(1) Valid `v=DKIM1` version tag (must be first). (2) Required `p=` public-key tag present. (3) `k=` key type is rsa or ed25519. (4) `h=` hash algorithms are from {sha1, sha256, sha512}. (5) `s=` service type is email or *. (6) `t=` flags are from {y, s, i, ...}. (7) Public key is valid base64. (8) Empty `p=` is flagged as a revoked key. (9) Weak 1024-bit RSA key warning. (10) Tag-order check (v= must be first). (11) Multiple DKIM records on the same selector name flagged. (12) Estimated key bit length (1024/2048/4096 for RSA, 256 for Ed25519). Every issue comes with a plain-English explanation and a suggested fix.

How do I generate a DKIM key pair with OpenDKIM or openssl?

The tool generates the exact commands for you. For OpenDKIM: `opendkim-genkey -s -d -b 2048 -r` produces ` .private` (private key — keep on your mail server) and ` .txt` (the DNS TXT record). For openssl RSA: `openssl genrsa -out private.key 2048` then `openssl rsa -in private.key -pubout -outform der 2>/dev/null | openssl base64 -A` produces the p= value. For Ed25519: `openssl genpkey -algorithm Ed25519 -out private.key` then `openssl pkey -in private.key -pubout -outform der 2>/dev/null | openssl base64 -A`. The private key NEVER leaves your server — only the public key goes in DNS.

What do the t= flags mean (y, s, i)?

The `t=` tag is a colon-separated list of flags. `t=y` means the domain is testing DKIM — receivers should treat the signature as valid but not enforce (do not quarantine/reject on failure). `t=s` means the key is in strict mode — the signature must match the exact i= identity (no subdomain matching). `t=i` (RFC 8301) is deprecated/obsolete. Remove `t=y` before you go to enforcement. The recommended production setting is `t=s` (or omit `t=` entirely for relaxed mode).

What extra features does this tool have compared to other DKIM tools?

(1) Visual generator for v / k / p / h / s / t / n tags. (2) RSA 1024/2048/4096 + Ed25519 key-type selector with bit-length badges. (3) RFC 6376 syntax validator with 12+ checks. (4) Per-tag plain-English explanations (`explainTag` / `explainFlag`). (5) Public-key bit-length estimator (1024/2048/4096 for RSA, 256 for Ed25519). (6) Weak-key warning for 1024-bit RSA. (7) Revoked-key detector (empty p=). (8) TXT record splitter for >255-char 2048/4096-bit keys (Bind-format). (9) dig / nslookup / kdig (DoH) / curl DoH lookup commands per selector+domain. (10) OpenDKIM keygen + openssl RSA + openssl Ed25519 command generator. (11) Multiple-DKIM-record detector. (12) Common-selector auto-detection list (google, selector1, selector2, k1, mandrill, default, s1, mail). (13) Tag reference table. (14) Copy/download record. (15) localStorage history (max 20, stores only metadata). (16) Shareable URL. 100% client-side — your private key never touches this tool.

Developer Runs in your browser

DKIM Record Generator & Validator

Build a valid DKIM DNS TXT record (selector._domainkey) from the v / k / p / h / s / t / n tags (RSA 1024/2048/4096 or Ed25519), validate any existing record against RFC 6376, decode every tag with plain-English explanations, estimate the public-key bit length, generate dig / nslookup / kdig (DoH) lookup commands for the selector, generate OpenDKIM keygen + openssl key-generation commands, and split long 2048/4096-bit TXT records into publishable chunks. 100% client-side generation and validation; live lookup requires the network via the generated dig commands.

100% Private Works Offline Instant

DKIM Record Builder

Selector

Domain

DNS name: default._domainkey.example.com

Key type

RSA key size (for keygen command only — does NOT affect the record)

Public key (base64 — the p= value)

The private key stays on your mail server — NEVER paste it here. Only the public key goes in DNS.

Hash algorithms (h=) — optional

Service type (s=) — optional

Flags (t=) — optional

y = test mode (do not enforce). s = strict selector. i = obsolete.

Notes (n=) — optional

Generated Record

v=DKIM1; k=rsa; p=; h=sha256; s=email; t=s

Length

42 chars

Key type

rsa

Est. bits

—

Valid

Yes

Key-pair generation commands

Run these on your mail server to generate a key pair. The private key stays on the server; the public key (base64 output) goes in the p= field above.

opendkim-genkeyOpenDKIM — generate RSA key pair

opendkim-genkey -s default -d example.com -b 2048 -r

Generates default.private (private key — keep on your mail server, NEVER publish) and default.txt (the ready-to-publish DNS TXT record). -r restricts the key to email use. -b 2048 sets the RSA modulus size.

opensslopenssl — RSA private key

openssl genrsa -out default.private 2048

Generate a 2048-bit RSA private key. Keep this on your mail server; never publish it.

opensslopenssl — RSA public key (DER + base64)

openssl rsa -in default.private -pubout -outform der 2>/dev/null | openssl base64 -A

Derive the base64-encoded SubjectPublicKeyInfo (the p= tag value) from the private key. Paste the output into the p= field above.

Verify with dig

Run these in your terminal to look up the published DKIM record for default._domainkey.example.com.

digdig TXT +short

dig +short TXT default._domainkey.example.com

List the TXT record(s) on default._domainkey.example.com. Look for the one starting with "v=DKIM1".

digdig TXT (filtered for DKIM)

dig +short TXT default._domainkey.example.com | grep '^"v=DKIM1'

Filter dig output to show only DKIM records. Multiple lines = multiple DKIM records (invalid).

digdig TXT (full)

dig +noall +answer TXT default._domainkey.example.com

Show the full TXT answer section with TTL.

digdig @resolver TXT

dig +short TXT default._domainkey.example.com @1.1.1.1

Query Cloudflare DNS (1.1.1.1) directly — useful for cached-vs-authoritative comparison.

kdigkdig (DNS-over-HTTPS)

kdig +https @1.1.1.1 TXT default._domainkey.example.com

DNS-over-HTTPS lookup via Cloudflare. Bypasses local DNS / firewall inspection.

nslookupnslookup TXT

nslookup -type=TXT default._domainkey.example.com

Cross-platform TXT lookup (Windows-friendly).

curlDoH via curl (Cloudflare)

curl -s 'https://cloudflare-dns.com/dns-query?name=default._domainkey.example.com&type=TXT' -H 'accept: application/dns-json' | jq '.Answer'

Fetch the TXT records as JSON via DNS-over-HTTPS. Pipe through jq for pretty output.

hosthost TXT

host -t TXT default._domainkey.example.com

Quick TXT lookup via the `host` utility (BIND).

Common-selector auto-detection

Try each common selector against example.com to discover which one a third-party sender (Google, SendGrid, …) is using.

defaultdig +short TXT default._domainkey.example.com

googledig +short TXT google._domainkey.example.com

selector1dig +short TXT selector1._domainkey.example.com

selector2dig +short TXT selector2._domainkey.example.com

k1dig +short TXT k1._domainkey.example.com

k2dig +short TXT k2._domainkey.example.com

mandrilldig +short TXT mandrill._domainkey.example.com

s1dig +short TXT s1._domainkey.example.com

s2dig +short TXT s2._domainkey.example.com

maildig +short TXT mail._domainkey.example.com

smtpdig +short TXT smtp._domainkey.example.com

dkimdig +short TXT dkim._domainkey.example.com

Tag reference

v=Versionrequired

DKIM version. MUST be the first tag and the value MUST be exactly `DKIM1` (case-insensitive). Identifies the TXT record as a DKIM key record (vs. other TXT records on the same name).

k=Key type

Public-key algorithm. Default is `rsa`. RFC 8463 adds `ed25519` (smaller keys, faster verification). Receivers must support the chosen algorithm or signatures will be ignored.

p=Public keyrequired

Base64-encoded public key (DER-encoded SubjectPublicKeyInfo for RSA, raw 32-byte key for Ed25519). An empty `p=` value REVOKES the key — receivers will treat any signature using this selector as a permanent failure. Generate with opendkim-genkey or openssl; the corresponding private key stays on your mail server.

h=Acceptable hash algorithms

Colon-separated list of hash algorithms the signer may use (`sha1:sha256` etc.). Default allows all algorithms the receiver supports. sha1 is weak — prefer sha256 or sha512. If omitted, the receiver picks.

s=Service type

Colon-separated list of service types this key may sign for. Default is `*` (any). `s=email` restricts to email — receivers should refuse to verify signatures for other services. Most domains set `s=email` or omit the tag.

t=Flags

Colon-separated flags. `y` = test mode (do not enforce failures). `s` = strict selector (signature i= must match the exact selector+domain, no subdomain matching). `i` = obsolete (RFC 8301). Remove `t=y` before going to enforcement.

n=Notes

Human-readable notes for the DNS admin. Not used by receivers. Avoid putting sensitive info here — DNS TXT records are public.

t= flags

yTest mode

Domain is testing DKIM. Receivers should treat the signature as valid but NOT enforce failures (do not quarantine or reject). Remove before going to enforcement.

sStrict selector

Signature i= must match the exact selector+domain. Subdomains may not use this key. Recommended for production domains.

iObsolete (RFC 8301)

Deprecated flag. RFC 8301 removed the `i` flag — receivers should ignore it. Remove from your record.

Privacy: All generation and validation runs locally. The private key NEVER touches this tool — only the base64 public key (which is already public in DNS) is processed. History stores only operation metadata (action + key type + estimated bits + ts), never the public key, selector, or domain. Live lookup requires the network via the dig commands above.

How to use

Enter your input in the tool above.
Adjust any options to your preference.
Use the Copy or Download buttons to save the result.
Everything happens locally — your data never leaves your browser.

All tools