TL;DR

DKIM signs every outgoing email with a private key and lets receivers verify the signature using a public key published in DNS. To set up DKIM, generate a 2048-bit RSA keypair, publish the public key as a TXT record at <selector>._domainkey.yourdomain.com, and install the private key on your mail server. This tool generates the keypair in your browser using WebCrypto, so nothing leaves your machine.

DKIM Keypair Generator

A short label of letters, digits, hyphens and dots, like mail2026 or s1.mail. You'll publish the key at <selector>._domainkey.yourdomain.com.
Key size:

Keys are generated locally with WebCrypto (crypto.subtle.generateKey). Nothing is sent to any server.

DKIM Lookup

What Is DKIM?

DKIM (DomainKeys Identified Mail, defined in RFC 6376) is a DNS-based email authentication method. Here's how it works:

  1. You generate an RSA keypair: a public key and a private key.
  2. You publish the public key as a DNS TXT record at <selector>._domainkey.yourdomain.com.
  3. You install the private key on your mail server (MTA).
  4. When your MTA sends a message, it cryptographically signs the headers and body with the private key. The signature goes in a DKIM-Signature header.
  5. Receiving mail servers look up your public key via DNS and verify the signature. If verification succeeds, the message is proven authentic and unaltered.

DKIM is one third of the cold email authentication trio: SPF + DKIM + DMARC. All three are required for cold email in 2026.

Selectors Explained

A selector is a short label (like default, google, dkim, or s1) that lets a single domain publish multiple DKIM keys. Each service that signs email on your behalf typically gets its own selector:

Selectors also enable key rotation. To rotate, create a new selector with a fresh keypair, publish the new public key, swap your MTA config, wait 24 hours for mail in flight to verify, then remove the old TXT record.

How to Publish Your DKIM Record

  1. Generate your keypair above.
  2. Copy the public key TXT value.
  3. Log in to your DNS host.
  4. Create a new TXT record with host/name <selector>._domainkey, for example mail2026._domainkey.
  5. Paste the v=DKIM1; k=rsa; p=... value. TTL can stay at the default. A 2048-bit key is longer than 255 characters; most DNS hosts split it automatically, and if yours asks, split it into several quoted strings inside the same TXT record (never into separate records).
  6. Save. Wait 1-15 minutes for propagation.
  7. Download the private key (.pem) and install it on your MTA. Verify with the DKIM Lookup above.

Using Winnr? Skip all of this. When Winnr hosts a domain's DNS, it generates the DKIM key, signs your mail with it, and publishes the TXT record at dkim._domainkey for you. For a manually connected domain, Winnr shows the exact DKIM value to copy. See Winnr pricing for mailboxes with SPF, DKIM, and DMARC set up automatically.

Related tools: SPF Record Generator · DMARC Record Generator · Domain Health Checker · Cold Email Calculator. Related reading: Cold Email DNS Setup Checklist.

Frequently Asked Questions

What is a DKIM record?

DKIM (DomainKeys Identified Mail) is a DNS TXT record that publishes your domain's public key. Your mail server signs outgoing messages with the matching private key, and receiving servers verify the signature by looking up the public key. DKIM proves a message genuinely came from your domain and wasn't altered in transit.

Do I need DKIM for cold email?

Yes. Since February 2024, Gmail and Yahoo require bulk senders (more than 5,000 messages a day) to sign mail with DKIM, and Gmail requires every sender to pass SPF or DKIM. Cold email without DKIM can't pass DMARC through DKIM alignment and is far more likely to land in spam or be rejected.

What is a DKIM selector?

A selector is a short label that lets you publish multiple DKIM keys for the same domain. For example, you might have default._domainkey.example.com for your own mail server, google._domainkey.example.com for Google Workspace, and s1._domainkey.example.com for SendGrid, each with its own keypair.

Should I use 1024-bit or 2048-bit DKIM keys?

2048-bit. RFC 8301 requires at least 1024 bits and recommends 2048, and 1024-bit keys are now considered weak. This tool defaults to 2048-bit; the 1024-bit option exists only for DNS hosts that can't store a longer TXT value.

Is it safe to generate a DKIM keypair in the browser?

Yes. This tool uses the browser's built-in WebCrypto API (crypto.subtle.generateKey), which produces cryptographically secure keys locally. The private key never leaves your machine and is not stored anywhere by Winnr. For extra caution, use a private window and download the private key right away.

How do I install the private key on my mail server?

It depends on your mail server. With Postfix and OpenDKIM, keys usually live in /etc/opendkim/keys/yourdomain.com/<selector>.private and are referenced from the KeyTable. Exim reads the path set in its dkim_private_key option. Winnr manages DKIM keys automatically, so there is nothing to install for Winnr mailboxes.

Does Winnr set up DKIM automatically?

Yes. When Winnr hosts a domain's DNS, it generates the DKIM key, signs outgoing mail with it, and publishes the public key at dkim._domainkey.yourdomain.com automatically. For a domain connected with manual DNS, Winnr shows the exact DKIM value to copy into your DNS host.

How do I check my DKIM record?

Use the DKIM Lookup on this page. Enter the selector and domain and the tool looks up <selector>._domainkey.<domain> over DNS-over-HTTPS (Google Public DNS, with Cloudflare as a fallback). From a terminal, run dig TXT selector._domainkey.example.com +short.

Should I rotate my DKIM keys?

Rotating every 6 to 12 months is common practice. Create a new selector (for example mail2026q4), publish the new public key, switch your mail server to the new selector, wait at least 24 hours, then remove the old DNS record. This limits exposure if a private key is ever compromised.