Generator · RFC 6376 · RFC 8463
DKIM key generator
The sending server signs every message with the private key, and receivers check the signature with the public key in DNS. The key pair is made here, in your browser: the private key is not sent anywhere.
The generated keys
Save the private key now: the page does not keep it, and we do not have it.
-
01The private key
It goes only on the server that signs the mail (for example in the OpenDKIM or Exim configuration), with restricted access to the file. Whoever holds it can sign mail on behalf of the domain.
s202611.privatePKCS#8 PEM -
02The DNS record
Copy the value into the domain's DNS panel, at the name and type below.
TXT- Name (host)
- Type
TXT- TTL (seconds)
3600
The value is longer than 255 characters, the most a TXT string holds: in the DNS panel enter it as 2 quoted strings in the same record. Servers join them back without a space (RFC 7208 section 3.3).
-
03The check
Once published, check that DNS serves exactly this key. The check opens in a new tab and receives only the public key, so this page, with the private key, stays open.
From key to signed mail
Generate the key pair and save the private key on the server that sends the mail.
Publish the TXT record, then check that DNS serves the same key.
Start signing with the new selector and send a message to the delivery test: the signature must show as
pass.
The key with OpenSSL
The same key pair, made on your own computer. The first command writes the private key, the second prints the value for p=.
RSA 2048opensslopenssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out s202611.private openssl pkey -in s202611.private -pubout -outform DER | openssl base64 -A
Ed25519opensslopenssl genpkey -algorithm ed25519 -out s202611.private openssl pkey -in s202611.private -pubout -outform DER | tail -c 32 | openssl base64 -A
The TXT record, at s202611._domainkey. + domain: v=DKIM1; k=rsa; p= followed by the printed value (k=ed25519 for Ed25519).
DKIM keys in short
- What DKIM does
The sending server adds a
DKIM-Signatureheader with the domain (d=) and the selector (s=). The receiver asks for the public key ats._domainkey.d(RFC 6376 section 3.6.2.1) and verifies the signature. The signature stays valid through forwarding. - Selectors and key changes
RFC 6376 section 3.1: for a new key use a new selector and publish both keys while mail is still in transit; sign with the new one, and at the end of the transition remove the old record.
- RSA or Ed25519
RFC 8301: signers MUST use RSA keys of at least 1024 bits and SHOULD use at least 2048, and verifiers must accept keys from 1024 to 4096 bits. Ed25519 (RFC 8463) is shorter; to be verified by older servers too, the message carries two signatures with different selectors (section 4).
- Where the private key lives
The keys are made with WebCrypto, in the browser. The private key is not sent to exim.ro and is not saved by the page; the check receives only the public key, the one that sits in DNS anyway.
If your mail goes out through Google Workspace, Microsoft 365 or a hosting panel that signs by itself, use the key generated there: the private key has to stay with whoever signs.