Free DKIM Generator

Create a DKIM key pair and DNS record for your domain. Sign your outgoing email and prove it really comes from you.

DKIM Generator by

Never worry about DNS set up again

With Mailforge and Infraforge all of that will be done for you, no extra effort or payment required. And then you can manage all your sequences in Salesforge.

Other Forges

Explore The Forge Stack

Google & MS365 Infrastructure

Infraforge

Private Email Infrastructure

Mailforge

Distributed Email Infrastructure

Warmforge

Email Deliverability Center

What Is a DKIM Generator?

A DKIM generator creates the key pair and DNS record you need to sign your email. DKIM, short for DomainKeys Identified Mail, works by signing outgoing mail with a private key and publishing the matching public key in DNS under a selector. Providers use that public key to verify your message. Generating the pair correctly, with the right format and key length, is what makes signing work on the first try. The generator outputs both keys and the record ready to deploy.
‍
‍

How the DKIM Generator Works

1. Choose a selector and key length: Pick a selector name and a key length, with 2048-bit recommended.
‍
2. Generate the key pair: The tool creates a matching public and private key.
‍
3. Publish the public key: Add the public key to your DNS as a TXT record under your selector.
‍
4. Configure your mail server: Add the private key to your sending platform so your mail gets signed.

Why It Matters?
‍

Signing Is a Requirement, Not an Option

Mailbox providers increasingly expect signed mail, and unsigned email is treated with suspicion. Setting up DKIM is a core step in landing in the inbox at scale. The generator gives you correctly formatted keys so you can get signing in place quickly.

Get It Right the First Time

DKIM fails when the public and private keys do not match, or when the record is malformed. Generating both halves together removes that risk, so your setup verifies cleanly instead of failing silently.

Strengthen Your Whole Setup

DKIM pairs with SPF and DMARC to form the authentication stack providers look for. Adding proper DKIM signing strengthens your sender reputation and improves how your domain is trusted over time.

What does a DKIM generator create?

It creates a public and private key pair plus the DNS record you need to sign email. The public key goes in your DNS, the private key goes in your mail server, and together they let providers verify your messages.

‍

What key length should I use?

Use 2048-bit. It is the current standard and stronger than 1024-bit. Most providers support it, so choose 2048 unless your DNS host has a length limit that forces a shorter key.

‍

Is the DKIM generator free?

Yes, the DKIM Generator tool is completely free to use.

How do I confirm DKIM is working?

After adding the keys, use a DKIM checker. Enter your domain and selector, and it confirms the record is live and the key is valid, so you know signing is active before you send.

‍

What is the difference between the public and private DKIM key?

The private key stays on your mail server and signs outgoing email. The public key goes in your DNS so providers can verify that signature. They are a matched pair, and both are needed for DKIM to work.

How often should I rotate DKIM keys?

Rotating keys periodically, such as once or twice a year, limits the damage if a private key is ever exposed. Generate a new pair, publish the new public key, switch signing to the new private key, then remove the old record.

How does DKIM work with SPF and DMARC?

DKIM, SPF, and DMARC are complementary protocols that together form a robust email authentication framework. DKIM verifies that the email content hasn’t been altered and is sent from an authorized source by using cryptographic signatures. SPF (Sender Policy Framework) specifies which mail servers are allowed to send emails on behalf of your domain. DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties these protocols together by enforcing alignment between SPF and DKIM and allowing domain owners to specify how unauthenticated emails should be handled.

‍

Can I use the same DKIM key for multiple domains?

It is better to generate a separate key pair for each domain. Reusing one key across domains weakens your setup and complicates rotation. Generate a fresh pair per domain and selector.