Template checker · Mailbox calculator · SPF generator · DMARC generator · DKIM generator · Deliverability test

DKIM generator

Build a v=DKIM1; …; p=<public-key> TXT record from a base64-encoded RSA public key. The output is published at <selector>._domainkey.<your-domain>. Records longer than 255 octets are split into chunked quoted strings per RFC 1035.

Selector

Public-facing label; common values are default, google, selector1.

Domain

Public key (base64)

Paste the body only — strip -----BEGIN PUBLIC KEY----- headers + line breaks.

Hash algorithms (h=)

Service type (s=)

Restrict to exact domain (t=s) Mark as testing key (t=y)

DNS host

(enter selector + domain)

Type

TXT

Value (single string)

(paste a base64 public key)

How DKIM works (in 60 seconds)

Your mail server signs every outbound message with a private key. Receiving servers fetch the matching public key from your DNS at the path <selector>._domainkey.<domain> and verify the signature. A valid signature attests that the message wasn't modified in transit AND that the sender controls the domain. DMARC then enforces "must DKIM-pass" policy.

Rotate keys at least yearly (every 6 months recommended). Use a different selector for each rotation so old signatures stay verifiable while the new key takes over.