IPTOOL TR My IP

Email

DKIM Generator: RSA key and TXT

Build a 2048/4096-bit RSA DKIM key pair, TXT and BIND record. Not stored.

Generate an RSA key pair for your own mail server. If you use Google Workspace or Microsoft 365, publish their panel record — do not mint a second pair here.

google and selector1 belong to those providers. On your own MTA use s1, mail or k1. Several selectors can be live at once.

Key size
  1. Pick a selector and size, then generate. The pair is made for this request; IPTOOL does not store it.
  2. Publish the public key as TXT at selector._domainkey. TTL 300–3600 is enough.
  3. Keep the private key only on the MTA (OpenDKIM, OpenSMTP, cPanel). Never commit it to git or paste it into chat.

Queries leave from this Linux server, not your ISP DNS. Free. Cached answers can differ for a short time.

Today 0 / 40 queries

DKIM Generator outputs

The pair exists only for this request; it is not stored. 1024-bit is not generated.

Part Purpose Note
DNS name selector._domainkey TXT type
TXT / BIND v=DKIM1; k=rsa; p=… 255-char split
Private key MTA KeyFile PEM chmod 600
2048 / 4096 RSA size 2048 recommended

What DKIM Generator produces

Builds an RSA pair on the server: PKCS#1 PEM private key (OpenDKIM BEGIN RSA PRIVATE KEY) and SPKI PEM public key. DNS p= is that SPKI DER with PEM headers stripped.

DKIM Checker only looks up an existing record. This page is generation-only. If Google/Microsoft hosts your mail, publish their TXT/CNAME; a second pair breaks signatures.

Examples

Recommended
selector=s1 · 2048-bitPanel-friendly.
BIND
quoted TXT chunksFor the 255-octet limit.
Prefix
dkimgen:Super box.

Publish and security

Put the TXT at selector._domainkey. TTL 300 while testing, then 3600. Never paste the private key into git or chat.

On a leak, publish empty p= immediately, mint a new selector, update the MTA. Leave the old selector with empty p= for a while.

Frequently asked questions

How is this different from Checker?

Checker reads the existing record; creation lives on this Generator page.

2048 or 4096?

2048 is enough and panel-friendly. 4096 needs a longer TXT; panels that truncate at 255 break the signature. We do not emit 1024.

Is it stored?

No. Leave the page and the private key is gone. IPTOOL keeps no copy.

Ed25519?

No. Many receivers still verify RSA only.

Prefix?

Type dkimgen: in the super box.

Do you generate 1024?

No. It is considered weak.

Next step?

Publish the TXT, verify with DKIM Checker, attach the PEM to the MTA.