← All tools
DKIM Generator
Generates a 2048-bit RSA key pair in your browser — nothing is sent anywhere. Publish the public record as a TXT and keep the private key on your mail server.
About these keys
This generates a 2048-bit RSA key pair in your browser using the Web Crypto API. Nothing is transmitted: the private key is produced on your machine and stays there, which is why there is no account and no rate limit. You publish the public half in DNS and keep the private half on the signing server.
- Is generating a key in a browser safe?
- The generation itself uses the same primitives a server would. The risk is what happens next: the key sits in a page you could leave open, and it reaches your signing server by whatever route you choose. If you have shell access, generating on the server avoids moving the private key at all.
- How do I publish the public key?
- Create a TXT record at selector._domainkey.yourdomain with the value shown. Pick a selector you can retire later - s1, or a date. If your DNS provider requires the value to be split, split it at 255 characters with nothing between the parts.
- How often should keys be rotated?
- Every six to twelve months is a reasonable default, and immediately if a signing server is ever compromised. Rotate by publishing the new selector first, leaving both live for a few days, then switching signing and removing the old record once nothing is verifying against it.