Mailwarm Email Warmup

DKIM Record Generator

Use this free DKIM record generator to create a 2048-bit key pair and the DNS record for your selector. Keys are generated in your browser and never leave it.

Your 2048-bit key pair is generated in your browser. The private key is never sent to Mailwarm or stored anywhere.

When to use this DKIM generator

Use it when you run your own mail server or send through a custom SMTP setup that asks you to supply a key, for example Postfix with OpenDKIM.

Hosted mailbox providers create their own keys, and you should use theirs. Google Workspace generates the key in the Admin console (Google's DKIM setup guide), and Microsoft 365 gives you two CNAME records in the Defender portal (Microsoft's DKIM setup guide). ESPs such as SendGrid, Mailgun and Postmark also provide their own DKIM records during domain setup.

DKIM record example

What a published DKIM record looks like (key shortened)

Host: mail2026._domainkey.yourdomain.com

Type: TXT

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...IDAQAB

How to set up DKIM on your own server

1

Pick a selector

Use a name you can rotate later, such as mail2026. Each selector holds one key, so a new selector lets you swap keys without downtime.

2

Publish the public key

Add the TXT record at selector._domainkey on your domain at your DNS provider.

3

Install the private key

Configure your mail server or signing service, such as OpenDKIM with Postfix, to sign outgoing mail with the private key and selector.

4

Test and monitor

Send a test email, check that DKIM shows PASS in the message headers, and keep a DMARC record publishing reports.

DKIM Record Generator: Common Questions

Everything you need to create and publish a DKIM record

Enter your domain and a selector in the DKIM record generator above and click generate. It creates a 2048-bit RSA key pair in your browser, gives you the TXT record to publish at selector._domainkey.yourdomain.com, and lets you download the private key for your mail server. If you use Google Workspace or Microsoft 365, generate the key in their admin console instead.

Yes, DKIM is essential today. Gmail and Yahoo require bulk senders to sign mail with DKIM alongside SPF and a DMARC record. DKIM is also the only one of the three that survives email forwarding, because the signature travels inside the message instead of depending on the IP address that delivered it.

In Microsoft 365 you don't create the DKIM key yourself. In the Microsoft Defender portal, open the DKIM settings for your custom domain, which shows two CNAME records for selector1 and selector2. Publish both CNAMEs at your DNS provider, wait for them to propagate, then enable DKIM signing for the domain in the same screen.

A DKIM record is a TXT record such as mail2026._domainkey.yourdomain.com with the value v=DKIM1; k=rsa; p= followed by a long base64 public key. The v tag sets the version, k sets the key type, and p holds the public key. Some providers publish it as a CNAME that points to their own TXT record instead.

Use a 2048-bit RSA key, which is what this generator creates and what Google, Microsoft and most providers recommend. 1024-bit keys still work but are considered weak, and some receivers distrust them. 4096-bit keys are allowed, but many DNS providers struggle with records that long, so 2048 bits is the practical standard.

Authentication is step one

DKIM proves who you are. Mailwarm builds the sender reputation that gets your emails into the inbox, with a deliverability audit and an account manager for every customer.

Start Email WarmupView Pricing