Free tool · Deliverability DKIM Record Generator & Setup Helper
DKIM is the one authentication record you can't just type out. The key comes from your email provider. This tool gives you the exact setup steps for your platform, then turns a raw public key into a correctly formatted TXT record when you need one.
Step 1: Where do you send from?
- 1In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
- 2Click "Generate new record" and choose 2048-bit key length.
- 3Publish the TXT record Google shows you at host "google._domainkey", then click "Start authentication".
Typical selector: google
Step 2: Build the TXT record (skip if your provider gave you CNAMEs; publish those instead)
Why there's no universal "DKIM generator"
DKIM works by signing every outgoing message with a private key that only your mail server holds, while the matching public key sits in DNS for receivers to verify against. That's why any honest DKIM tool starts with your provider's dashboard: the keypair must be generated where the signing happens. What we can do is give you the exact path for each provider, and format the DNS record correctly when you're handed a raw key.
TXT vs CNAME setups
Google Workspace and self-hosted mail use a TXT record: a public key published at selector._domainkey.yourdomain.com. That's what step 2 builds. Microsoft 365, Amazon SES, SendGrid, and most sending platforms use CNAME delegation instead: you publish pointers and the provider hosts (and rotates) the actual keys. If you were given CNAMEs, publish them as-is and skip the builder.
What the builder validates
Paste a key and we strip PEM armor, quotes, and line breaks automatically, verify it's valid base64, and estimate whether it's a 1024- or 2048-bit key, flagging the former since 2048-bit is the current standard. The output is the exact host and value to paste into your DNS dashboard.
Finish the authentication stack
DKIM alone isn't enough: pair it with an SPF record listing your senders and a DMARC policy that ties both to your visible From address. Then verify the setup end-to-end with the DKIM checker and the full deliverability test.
Rotating keys, monitoring alignment, and keeping this healthy across dozens of sending domains is part of every cold email infrastructure engagement we run. Background reading: SPF, DKIM & DMARC for cold email.
Frequently asked questions
How do I set up DKIM?
DKIM keys are generated by your email provider, not by a website. The private key has to live on the server that signs your mail. Pick your provider above for the exact steps: you enable DKIM in their dashboard, they hand you a DNS record (TXT or CNAMEs), and you publish it. If your provider gives you a raw public key instead of a ready record, paste it into step 2 and we'll build the TXT record for you.
What is a DKIM selector?
The selector is the label that tells receivers where to find your public key in DNS. A message signed with selector "google" points receivers to google._domainkey.yourdomain.com. Providers pick their own: Google Workspace uses "google", Microsoft 365 uses "selector1" and "selector2", SendGrid uses "s1"/"s2". Multiple selectors can coexist, which is how several tools can all sign for one domain.
Should I use a 1024-bit or 2048-bit DKIM key?
2048-bit, whenever your provider offers it. It's the current standard and what Google generates by default. 1024-bit keys still verify but are cryptographically weaker. If your key predates 2023, rotating to 2048-bit is a five-minute win. The generator estimates your key length automatically when you paste it.
My provider gave me CNAME records, not a TXT record. What do I publish?
Publish the CNAMEs exactly as given. That's delegated DKIM, used by Microsoft 365, Amazon SES, SendGrid, and most sending platforms. The CNAME points your selector at a record the provider hosts and rotates for you, which is strictly better than a static TXT. You only need this page's record builder when a provider hands you a raw public key.
How do I know DKIM is working?
Two checks: run our DKIM checker against your domain and selector to confirm the DNS record resolves and the key is valid, then email yourself at a Gmail address and use "Show original". You want DKIM: PASS with your domain, not the provider's. If the record exists but mail shows no signature, signing usually isn't switched on in the provider dashboard yet.
Keep your outbound landing.
DKIM Checker
Look up and validate your DKIM record. Don't know your selector? It tries the common ones and verifies your public key.
SPF Record Generator
v=spf1 include:_spf.google.com include:hubspotemail.net ~all
Pick your email platforms, add any server IPs, and copy a TXT record already checked against the 10-lookup limit.
DMARC Record Generator
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
Create a DMARC policy with reporting, pct and alignment options, and guidance on ramping safely from none to reject.
Want us to build your outbound system?
Skip the DIY. We'll orchestrate your entire outbound operation, on infrastructure registered in your name from day one.
Book your free ICP review →