Free DKIM Key Generator

DomainKeys Identified Mail (DKIM) is an email authentication method that uses public-key cryptography. Your mail server signs outgoing emails with a private key, and a corresponding public key is published in your DNS as a TXT record. Receiving servers verify the signature using the public key — proving the email was not altered in transit and genuinely comes from your domain. DKIM is essential for email deliverability and is required for DMARC to pass.

DKIM records are stored as DNS TXT records at a specific selector subdomain, in the format: selector._domainkey.yourdomain.com. You need to know the selector name — common ones are "default", "google", "s1", "s2", "k1". Enter the domain and selector in our DKIM Checker to instantly retrieve and validate the public key. If you do not know your selector, check your email sending platform settings or email headers from a sent message.

Common causes of DKIM failure: (1) The selector or domain is wrong — double check both. (2) The DKIM record was deleted or never published to DNS. (3) DNS propagation is still in progress — wait up to 48 hours after publishing. (4) The record exceeds 255 characters and was split incorrectly (DNS requires multi-string records for long DKIM keys). (5) The private key and public key do not match — regenerate using our DKIM Key Generator.

A DKIM selector is a string that points to the specific DKIM key record in DNS. It allows domains to have multiple DKIM keys simultaneously — for example one key per sending service. The selector is included in the DKIM-Signature header of every email you send (d=yourdomain.com; s=yourSelector). Common selector names include "google", "sendgrid", "k1", "default", and "mail".