Also needed
SPF Record Generator — authorize your sending IPs
DKIM proves a message wasn't altered. SPF proves the sending server is authorized. Most receivers want both.
Open the toolFree tool · No account
DKIM Record Generator — keys you actually control.
Generate a real RSA keypair with the Web Crypto API, entirely client-side. We never see your private key — only the public half goes into the DNS record you publish.
- Generated in your browser
- Private key never leaves your device
- Free, no account
Who this is for: teams running a self-hosted mail server, custom SMTP setup, or an ESP that lets you bring your own DKIM key (e.g. Amazon SES custom domains). If you send through Google Workspace or Microsoft 365, they generate and manage DKIM for you — check their admin console instead of using this tool.
1. Generate a keypair
Runs entirely in your browser using the Web Crypto API. The private key is never sent anywhere — not to InboxStack, not to any server. Closing this tab without saving it means it's gone for good.
Any short label — used to publish multiple keys per domain and rotate them later. Letters, numbers, and hyphens only.
Key size 2048-bit is the current standard. Only use 1024-bit if your sending platform can't handle a longer TXT record.
Your generated DNS record and private key will appear here.
How this works
DKIM, in plain English.
What is DKIM actually doing?
DKIM adds a cryptographic signature to each outgoing message, generated with your private key. The receiving server looks up your public key in DNS and verifies the signature — proving the message wasn't altered in transit and really came from a server that holds your private key.
Is it safe to generate a private key in a browser?
Yes — the Web Crypto API used here runs in a sandboxed, native browser implementation and the key is generated locally. Nothing is transmitted over the network during generation. That said, treat the downloaded .pem file exactly like a password: store it in a secrets manager or your mail server's config, not in a shared doc.
Why do some DNS providers need the record split into chunks?
DNS TXT records store data as one or more quoted strings, and older tooling caps each string at 255 bytes. A 2048-bit RSA public key encodes to roughly 390 base64 characters, so it needs two quoted strings back-to-back. Most modern providers (Cloudflare, Route 53) handle this automatically — the toggle above is for the ones that don't.
What if my ESP already manages DKIM for me?
Use theirs. Google Workspace, Microsoft 365, and most major ESPs generate and rotate DKIM keys automatically and give you a record to paste — this tool is for cases where nothing does that for you, like a self-hosted mail server or a custom domain on Amazon SES.
Keys rotate. Monitoring shouldn't stop
Know the moment a signature starts failing.
A DKIM key that gets accidentally removed, rotated wrong, or exceeds a provider's key-length limit fails silently until inbox rates drop. Brain checks DKIM validity continuously across every domain and selector you use.