DKIM keys explained: public, private, selectors and rotation
In short: DKIM uses a key pair. The private key signs your outgoing mail and lives only on your mail server. The matching public key is published in DNS so receivers can verify the signature. A selector labels each key so a domain can run several at once. Generate a pair safely with the DKIM Generator.
On this page
How the key pair works
DKIM is built on public-key cryptography. Your mail server uses the private key to create a unique signature for each message. The receiving server fetches your public key from DNS and checks the signature. Because only the holder of the private key can produce a signature the public key verifies, a valid DKIM signature proves the message is genuinely from your domain and was not altered.
Why the private key must stay secret
If someone gets your private key, they can sign mail that passes DKIM as your domain. That is why the private key stays on your mail server and nowhere else. The public key is safe to share: it can only verify signatures, not create them. This asymmetry is the entire point of the design.
What selectors are for
A selector lets a domain publish multiple DKIM keys at once, each at selector._domainkey.yourdomain.com. This is how you can sign mail from different services with different keys, and how you rotate keys without downtime: publish a new selector, switch to it, then retire the old one.
When to rotate keys
Rotate DKIM keys periodically for security, and immediately if you suspect a key was exposed. Rotation means generating a fresh pair under a new selector, publishing the new public key, moving your server to sign with it, and removing the old key once all in-flight mail has cleared. Check each step with the DKIM Checker.
Create a DKIM key pair
Generate a secure 2048-bit key in your browser and publish the public half in DNS.
Open the DKIM Generator →All free tools