If Google Workspace, Microsoft 365, Brevo, SES or Mailgun sends your mail, use the DKIM key they issue in their admin console instead of generating your own — this tool is for self-hosted or custom relays.
Free tool
Free DKIM Key Generator
Generate a 2048-bit RSA DKIM key pair in your browser. Publish the public key as DNS TXT, keep the private key on your mail server.
About this tool
A free DKIM key generator that runs entirely in your browser. Uses the Web Crypto API to create a 2048-bit RSA key pair, then formats the public key as a DKIM DNS TXT record you can paste straight into your DNS. Give the private key to your mail provider — or paste it into your outbound relay's DKIM signer.
How to use the Free DKIM Key Generator
- Enter your selector (e.g. 'default' or 'mail2025') and your domain.
- Click Generate to create a fresh 2048-bit RSA key pair in your browser.
- Copy the public key TXT record and add it to DNS at selector._domainkey.yourdomain.
- Copy the private key and hand it to your outbound mail provider.
- Send a test message and inspect the headers to confirm DKIM=pass.
Frequently asked questions
- Is the key really generated in my browser?
- Yes. We use the Web Crypto SubtleCrypto API (RSASSA-PKCS1-v1_5, SHA-256, 2048-bit). The private key never leaves your machine.
- Where do I add the public key?
- As a TXT record at selector._domainkey.yourdomain — for example, if your selector is 'mail2025' and your domain is 'example.com', the host is mail2025._domainkey.example.com.
- What if my provider issues the DKIM key for me?
- Many providers (Google Workspace, Microsoft 365, Brevo, SES, Mailgun) create the key on their side and give you the DNS records to paste. In that case use their key and skip this tool.
- How often should I rotate DKIM keys?
- At least once a year — or immediately if you suspect the private key has been exposed.