Free email-authentication toolkit
Generate a DKIM key pair and get everything needed to put it into service: the DNS TXT record to publish, the private key for your mail server, and the OpenDKIM lines that tie the two together. The key is created by your browser's own crypto and never leaves this tab — 100% in your browser; nothing is uploaded.
Choose a selector and a key size. Everything below is produced in this tab.
If your provider creates DKIM keys for you — Google Workspace, Microsoft 365, SendGrid, Mailchimp, Postmark, Zoho — this tool is not for you. Take the key from their admin panel: a key generated here will not match what they sign with.
Use this when you run your own mail server — Postfix with OpenDKIM, Exim, Haraka.
The domain is optional because the key pair does not depend on it — the domain only forms the name the record is published at.
The basics, briefly
It creates an RSA key pair with your browser's own Web Crypto, then formats the public half into the DNS TXT record you publish and the private half into a PEM file for your mail server. It does not switch DKIM on: signing happens in your mail server and verification happens at the receiver. Until your server is configured to sign with this key, publishing the record changes nothing.
A single DNS TXT string cannot exceed 255 characters, and a 2048-bit record is 410. Most panels — Cloudflare among them — accept the long value and split it internally. BIND zone files, Route 53 and some older panels need the value written as several quoted strings, which the result above can show you. A verifier joins them back together with nothing in between. DKIM key length and rotation covers the trade-off and how to rotate without a gap.
Nowhere but this tab. It is generated locally, held in memory, and offered to you as a download; closing the tab destroys it and we keep no copy. Install it on your mail server with permissions that let only the signing daemon read it — the OpenDKIM block above shows exactly that. If you would rather not trust a web page with a signing key at all, the same card gives you the equivalent openssl commands to run locally.
Check the record is actually live and readable first with the DKIM checker — a truncated or quote-mangled record is the most common cause. If it resolves cleanly, the problem is on the signing side: the selector your server signs with must match the one in the record name. Why DKIM fails walks through the rest.