Free email security tool
Paste the public key from your mail provider or signing system and enter the selector. You get the exact TXT host and value, with the key type and size read from the key itself.
Create a TXT record in your DNS zone with the host and value shown above. After DNS has updated, look it up with the DKIM Checker using the same selector.
DKIM uses a key pair. The private key stays on the system that signs your mail and must never leave it. Only the public key is published in DNS, and only the public key belongs in this form. If a private key is pasted, this page refuses to process it.
It does not create keys and does not check that your mail is actually signed with the matching private key. That is only visible in a real message, in the DKIM-Signature and Authentication-Results headers.
Add your domain to CloudSpex to monitor your DKIM selectors, SPF and DMARC continuously and get alerted when a record changes or disappears.
Start Monitoring FreeNo, deliberately. A private key created by a website has already been seen by someone other than you. Generate the key pair in your mail provider's admin panel or on your own mail server, then paste only the public key here to get the DNS record.
In your mail provider's DKIM settings, or in the s= value of the DKIM-Signature header of a message you sent. Google Workspace uses google by default; Microsoft 365 uses selector1 and selector2.
A 2048-bit RSA public key does not fit in a single 255-character DNS string. It must be published as several quoted strings inside one TXT record. Most DNS panels split it for you; if yours does not, split the value yourself at any point.
2048-bit. 1024-bit RSA keys still verify at most receivers but are considered weak, and 2048 bits is the current recommendation.