BUY WEBSITES
BUY DOMAINS
LOGIN
SIGNUP
DKIM Record Helper
A DKIM record helper assembles the DNS TXT record that lets receiving mail servers verify your messages were not altered in transit. You give it a selector, a domain, a key type, and the public key your mail provider issued, and it returns the exact host name (selector._domainkey.domain) and the TXT value (v=DKIM1; k=rsa; p=…) ready to paste into your DNS. The most common publishing mistake is a key that breaks across the 255-character DNS string limit, so the tool also produces a correctly split BIND zone-file version.
This tool is free and runs entirely in your browser. It performs no DNS lookup and sends nothing to a server: it formats and validates the values you paste, checks the selector and domain shape, confirms the key is plausible base64, and chunks long values the way DNS requires.
s1, google, k1
example.com
v=DKIM1; k=rsa; p=… string. Both work.
🔒 Private: everything runs in your browser. Nothing you paste is uploaded.
How to build and publish a DKIM record
Enter the four values your provider gives you, copy the host and TXT value, and add them as a TXT record in DNS. The record below updates as you type, and the validation panel flags anything that looks wrong before you publish.
Get the selector, domain, and public key right
The host name a DKIM record lives at is always selector._domainkey.domain, so the selector and domain must match exactly what your mail provider configured. The selector is the short label they assign, such as s1, google, or k1, and it lets you rotate keys by publishing a new selector without disturbing the old one. Paste the public key as either the raw base64 blob or the entire v=DKIM1 record. The helper extracts the p= value, strips quotes and whitespace, and rejoins any split chunks for you.
Assemble the TXT value in the right tag order
A DKIM TXT value is a list of tag-value pairs separated by semicolons. The version tag v=DKIM1 comes first, then the key type k=rsa or k=ed25519, an optional hash flag h=sha256, and finally the public key in p=. The tool builds this string in canonical order so receivers parse it cleanly. RSA keys are the most widely supported; ed25519 keys are far shorter but require a receiver that understands them, so many senders publish both under different selectors for coverage.
Split long keys across the 255-character DNS limit
A single DNS TXT character-string can hold at most 255 octets, and a 2048-bit RSA key easily exceeds that. Most managed DNS hosts accept the full value in one field and split it for you, but raw BIND zone files do not. The BIND tab breaks the value into 255-character quoted strings wrapped in parentheses, which BIND concatenates back into one record. Never insert spaces inside the base64 to break the line, because that changes the key and breaks verification.
DKIM record frequently asked questions
Q1What goes in the DKIM host or name field?
The host is always your selector, then the literal string _domainkey, then your domain, joined with dots: selector._domainkey.example.com. The selector is the short label your mail provider assigns. Some DNS panels want only the part before your domain, so they expect selector._domainkey, while others want the full name. The tool prints the complete host so you can shorten it if your panel auto-appends the domain.
Q2Should I use an RSA or ed25519 DKIM key?
RSA is the safe default because every receiver supports it; use a 2048-bit key, since 1024-bit is the weak minimum. Ed25519 keys are much shorter and cryptographically modern, but receivers that do not recognize them simply skip the signature. A common approach is to publish both, each under its own selector, so capable receivers use ed25519 while everyone else falls back to RSA without any failure.
Q3Why is my DKIM key too long for one TXT record?
DNS limits a single TXT character-string to 255 characters, and a 2048-bit RSA public key is longer than that. Managed DNS providers usually accept the whole value and split it internally, but a BIND zone file must split it manually into multiple quoted strings inside parentheses, which BIND rejoins. Use the BIND tab here to get the correctly chunked version, and never add spaces inside the base64 key.
Q4Does this tool generate or look up my DKIM key?
No. It does not create key pairs and it performs no DNS lookup. Your private and public key pair must come from your mail provider or your own keygen, because the private key has to stay on the signing server. This helper only formats the public key you already have into a valid record and validates its shape. Everything runs in your browser, so nothing you paste is uploaded.
Q5How do I check my DKIM record is working after publishing?
DNS changes can take from minutes to a day to propagate, so wait before testing. Then query the host with a TXT lookup, or send a test message to a mailbox that reports authentication results. A passing DKIM result confirms the published public key matches the private key signing your mail. If it fails, recheck that the selector, domain, and full p= value were copied without truncation.
