What is DKIM?
DKIM (DomainKeys Identified Mail) signs the headers and body of outbound mail with your private key. Receivers verify the signature with the public key in DNS. A valid signature means the message was not altered in transit and came from a sender authorised for that domain.
The record name is always selector._domainkey.yourdomain.com. v=DKIM1 is the version, k=rsa the algorithm, p= the Base64 public key. An empty p= revokes the key; old signatures will not verify.
What is the selector for?
A selector lets one domain publish several keys. For a rollover you publish a new selector (e.g. s2), switch the MTA, then revoke the old one with empty p=. That is a cutover without a gap.
Google Workspace usually uses google; Microsoft 365 uses selector1 and selector2. Do not reuse those names on your own MTA. Use s1, mail or k1. Your panel or OpenDKIM KeyTable names the live selector.
How key generation works
This tool builds an RSA pair on the server for your request: a PKCS#1 PEM private key (BEGIN RSA PRIVATE KEY, what OpenDKIM expects) and an SPKI PEM public key. The DNS p= value is that SPKI DER with PEM headers stripped — the format Gmail and Outlook read.
2048-bit is the baseline. 1024-bit is weak and is not generated. 4096-bit needs a longer TXT; cheap DNS panels often truncate at 255 characters and break the signature. If you are unsure, pick 2048.
RFC 1035 limits one TXT string to 255 octets. A 2048-bit record is ~400 characters, so it is split into two strings. Cloudflare, Route 53 and BIND concatenate them. On a single-box panel, paste the quoted BIND lines.
The key is not stored here. Refresh the page and the private key is gone. If Google, Microsoft or Fastmail hosts your mail, copy their TXT or CNAME; a second pair will not match their signatures.
Publish and the MTA
Put the TXT at selector._domainkey. Use TTL 300 while testing, then 3600. A CNAME to the provider’s record is common; then p= does not live in your zone and this tool follows the CNAME.
In OpenDKIM, Domain, Selector and KeyFile must name the same selector. SigningTable aligns d= with From. Postfix wires the milter via smtpd_milters and non_smtpd_milters. cPanel Email Authentication accepts the same PEM.
If the private key leaks, publish empty p= at once, generate a new selector, update the MTA. Leave the old selector with empty p= for a while so in-flight mail can still verify, then delete the record.