DKIM record generator
Turn a public key into a DKIM record, or generate a new key pair. Keys are made in your browser and never sent to us.
Any short name. Your mail server signs with the same one.
A PEM key, the bare key, or a whole DKIM record all work.
Your DKIM record
Paste a public key and your record appears here.
Records in place
Now send from a domain inbox providers trust
SuperSend warms up every inbox and checks your DNS and bounces as you send, with email and LinkedIn in one sequence.
What DKIM does
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. Your mail server signs with a private key, and receivers check the signature against the public key in your DNS.
A valid signature proves the message really came from your domain and wasn’t changed on the way. Google and Yahoo require it from anyone sending in volume, and DMARC depends on it.
How to set it up
- 1
Get a key. Paste the public key your mail server or email service gave you, or generate a new pair here.
- 2
Add a TXT record. At your DNS provider, create a TXT record with the host shown (selector._domainkey) and paste the value.
- 3
Turn on signing. Install the private key on your mail server and start signing, then check it with the deliverability checker.
Questions about DKIM
What is a DKIM selector?
A short name that lets one domain publish several DKIM keys, for example one per email service. The record lives at selector._domainkey.yourdomain, and your mail server puts the selector in every signature.
Should I use a 1024-bit or 2048-bit key?
2048-bit. 1024-bit keys still work, but they’re weaker and some receivers trust them less. Only use 1024 if your DNS provider can’t store a longer record.
Is it safe to generate my private key here?
The key pair is generated by your browser’s built-in cryptography and never leaves your device: nothing is sent to our servers. Save the private key straight away, because we can’t recover it.
My DNS provider says the record is too long. What do I do?
A 2048-bit key makes a record longer than 255 characters. Most providers split it automatically. If yours doesn’t, tick "Split into 255-character strings" and paste that version.
How do I know DKIM is working?
Run the deliverability checker with your selector, and send yourself an email: in Gmail, "Show original" should say DKIM: PASS.
Setup checks out? Start sending.
SuperSend runs cold email and LinkedIn in one sequence, with warmup on every inbox and DNS and bounce monitoring built in. Set up free, no card. 7-day free trial when you launch.