IPTOOL TR My IP

Email

DKIM record and key generation

Find the DKIM key by selector and validate the RSA record.

Queries leave from this Linux server, not your ISP DNS. Free. Cached answers can differ for a short time.

What is DKIM?

DKIM (DomainKeys Identified Mail) signs the headers and body of outbound mail with your private key. Receivers verify the signature with the public key in DNS. A valid signature means the message was not altered in transit and came from a sender authorised for that domain.

The record name is always selector._domainkey.yourdomain.com. v=DKIM1 is the version, k=rsa the algorithm, p= the Base64 public key. An empty p= revokes the key; old signatures will not verify.

What is the selector for?

A selector lets one domain publish several keys. For a rollover you publish a new selector (e.g. s2), switch the MTA, then revoke the old one with empty p=. That is a cutover without a gap.

Google Workspace usually uses google; Microsoft 365 uses selector1 and selector2. Do not reuse those names on your own MTA. Use s1, mail or k1. Your panel or OpenDKIM KeyTable names the live selector.

How key generation works

This tool builds an RSA pair on the server for your request: a PKCS#1 PEM private key (BEGIN RSA PRIVATE KEY, what OpenDKIM expects) and an SPKI PEM public key. The DNS p= value is that SPKI DER with PEM headers stripped — the format Gmail and Outlook read.

2048-bit is the baseline. 1024-bit is weak and is not generated. 4096-bit needs a longer TXT; cheap DNS panels often truncate at 255 characters and break the signature. If you are unsure, pick 2048.

RFC 1035 limits one TXT string to 255 octets. A 2048-bit record is ~400 characters, so it is split into two strings. Cloudflare, Route 53 and BIND concatenate them. On a single-box panel, paste the quoted BIND lines.

The key is not stored here. Refresh the page and the private key is gone. If Google, Microsoft or Fastmail hosts your mail, copy their TXT or CNAME; a second pair will not match their signatures.

Publish and the MTA

Put the TXT at selector._domainkey. Use TTL 300 while testing, then 3600. A CNAME to the provider’s record is common; then p= does not live in your zone and this tool follows the CNAME.

In OpenDKIM, Domain, Selector and KeyFile must name the same selector. SigningTable aligns d= with From. Postfix wires the milter via smtpd_milters and non_smtpd_milters. cPanel Email Authentication accepts the same PEM.

If the private key leaks, publish empty p= at once, generate a new selector, update the MTA. Leave the old selector with empty p= for a while so in-flight mail can still verify, then delete the record.

Frequently asked questions

What is a DKIM selector?

The first label of the DNS name. For a rollover, publish a new selector, switch the MTA, then revoke the old key with empty p=.

What if p= is empty?

The key was revoked. New signatures will not verify. On a leak, publish empty p= first, then issue a new selector.

Which selectors should I try?

On lookup: google, selector1, selector2, default, k1, s1, mail. For your own MTA generate s1 or mail — do not take provider names.

Can DKIM be a CNAME?

Yes; providers CNAME selector._domainkey to their record. The tool follows CNAME. If you generated your own key, publish TXT, not CNAME.

What is t=y?

Test mode. Signatures are made but failures may not be penalised. Remove it in production.

Private key leaked?

Publish empty p= (revoke), issue a new key and selector, update the MTA. Leave the old selector with empty p= for a while.

2048 or 4096?

2048 is enough and panel-friendly. 4096 needs a longer TXT; panels that truncate at 255 will break the signature. We do not emit 1024.

Do you generate Ed25519?

No. RFC 8463 exists but many receivers still verify RSA only. Generation is RSA.