How to generate a DKIM key pair and publish it correctly
In short: To set up DKIM, generate a key pair: a private key that stays on your mail server and a public key you publish in DNS at selector._domainkey.yourdomain.com. A free DKIM Generator creates a 2048-bit pair entirely in your browser, so the private key never leaves your machine.
On this page
When to generate your own DKIM keys
Most mailbox providers (Google Workspace, Microsoft 365) generate DKIM keys for you, and you should use theirs when available. You generate your own when you run your own mail server, use a tool that asks you to supply a key, or want to rotate to a stronger 2048-bit key. Generating in the browser means the private key is never transmitted anywhere.
How to generate DKIM keys step by step
- Open the DKIM Generator. Go to the free Inboxlogy DKIM Generator.
- Choose a selector. Pick a label like
mail2026. It identifies this key in DNS. - Generate the 2048-bit pair. The tool creates both keys locally using your browser's crypto.
- Publish the public key. Add it as a TXT record at
selector._domainkey.yourdomain.com. - Install the private key. Add it to your mail server's DKIM settings so it can sign outgoing mail.
Keeping the private key safe
The whole system depends on the private key staying private. Never publish it in DNS, never email it, and never paste it into an untrusted site. A browser-based generator helps here because the key is created on your device and never sent to a server. Store it only in your mail server's secure configuration.
Verify and rotate
After publishing, confirm the public key is live with the DKIM Checker using your selector. Rotate keys periodically by generating a new pair under a new selector, publishing it, switching your server to sign with it, then retiring the old one. Pair DKIM with SPF and DMARC for full authentication.
Generate a DKIM key pair free
Create a 2048-bit key in your browser. The private key never leaves your device.
Open the DKIM Generator →All free tools