DKIM Record Generator & Setup Helper
DKIM is the one authentication record you can't just type out — the key comes from your email provider. This tool gives you the exact setup steps for your platform, then turns a raw public key into a correctly formatted TXT record when you need one.
Step 1 — Where do you send from?
- 1In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
- 2Click "Generate new record" and choose 2048-bit key length.
- 3Publish the TXT record Google shows you at host "google._domainkey", then click "Start authentication".
Typical selector: google
Step 2 — Build the TXT record (skip if your provider gave you CNAMEs — publish those instead)
Why there's no universal "DKIM generator"
DKIM works by signing every outgoing message with a private key that only your mail server holds, while the matching public key sits in DNS for receivers to verify against. That's why any honest DKIM tool starts with your provider's dashboard: the keypair must be generated where the signing happens. What we can do is give you the exact path for each provider — and format the DNS record correctly when you're handed a raw key.
TXT vs CNAME setups
Google Workspace and self-hosted mail use a TXT record: a public key published at selector._domainkey.yourdomain.com — that's what step 2 builds. Microsoft 365, Amazon SES, SendGrid, and most sending platforms use CNAME delegation instead: you publish pointers and the provider hosts (and rotates) the actual keys. If you were given CNAMEs, publish them as-is and skip the builder.
What the builder validates
Paste a key and we strip PEM armor, quotes, and line breaks automatically, verify it's valid base64, and estimate whether it's a 1024- or 2048-bit key — flagging the former since 2048-bit is the current standard. The output is the exact host and value to paste into your DNS dashboard.
Finish the authentication stack
DKIM alone isn't enough: pair it with an SPF record listing your senders and a DMARC policy that ties both to your visible From address. Then verify the setup end-to-end with the DKIM checker and the full deliverability test.
Rotating keys, monitoring alignment, and keeping this healthy across dozens of sending domains is part of every cold email infrastructure engagement we run. Background reading: SPF, DKIM & DMARC for cold email.
Frequently asked questions
DKIM keys are generated by your email provider, not by a website — the private key has to live on the server that signs your mail. Pick your provider above for the exact steps: you enable DKIM in their dashboard, they hand you a DNS record (TXT or CNAMEs), and you publish it. If your provider gives you a raw public key instead of a ready record, paste it into step 2 and we'll build the TXT record for you.
More free tools