Domain Audit HQ
← Back to Free Tools
RFC 6376 COMPLIANT • ZERO SIGN-UP NEEDED

Free DKIM Record Builder & Selector Generator

Format cryptographic DomainKeys Identified Mail (DKIM) TXT records and selectors for seamless email verification.

DKIM Record Builder & Selector Helper

Construct a valid DKIM TXT record for your domain's email selector (e.g. Google Workspace, Microsoft 365, Mailchimp).

DNS TXT HOST / NAME: google._domainkey
v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY_HERE

How DKIM Works & DNS Mechanics (RFC 6376)

DomainKeys Identified Mail provides cryptographic proof that an email was genuinely authorized by the domain owner and remained completely untampered during transit across intermediate relays.

DKIM DNS Record Tags

  • v=DKIM1: Identifies the record as a DKIM public key record.
  • k=rsa: Cryptographic algorithm (RSA is the ubiquitous standard; Ed25519 is emerging).
  • p=<base64>: Base64-encoded public key extracted from the signing keypair.
  • t=s: Optional flag stating that the selector cannot be used on subdomains.

Selector Subdomain Naming

DKIM records are published at [selector]._domainkey.[domain.com]. For instance:
• Google Workspace: google._domainkey.yourdomain.com
• Microsoft 365: selector1._domainkey.yourdomain.com
• SendGrid: s1._domainkey.yourdomain.com

Step-by-Step Deployment Guide: Publishing DKIM Records

Cloudflare

Add Record → Type: TXT → Name: selector._domainkey → Content: Paste v=DKIM1; k=rsa; p=... → TTL: Auto → Save. (Cloudflare automatically handles 2048-bit string chunking).

AWS Route 53

Hosted Zones → Create record → Record name: selector._domainkey → Type: TXT → Value: "v=DKIM1; k=rsa; p=..." → Save.

Common DKIM Errors & Troubleshooting

1. DKIM Signature Body Hash Did Not Verify (dkim=fail)

Cause: An email security gateway, antivirus scanner, or listserv altered message whitespace or appended a corporate disclaimer after the email was signed.

Fix: Ensure signing occurs at the final outbound gateway or configure relaxed canonicalization (c=relaxed/relaxed).

2. Public Key Truncated by DNS 255-Byte Limit

Cause: 2048-bit keys exceed 255 characters. Older registrar DNS managers truncate the key without throwing an error.

Fix: Split the string into two quoted parts inside the TXT field: ("v=DKIM1; ..." "more_key...").

Frequently Asked Questions About DKIM

Answers to cryptographic key management, selector configuration, and DMARC alignment questions.

What is a DKIM record and how does cryptographic signing work?+
DKIM (DomainKeys Identified Mail, RFC 6376) is an email authentication method that uses public-key cryptography. The sender email server signs outbound messages with a private key, and the recipient server retrieves the public key published in your DNS TXT record to verify that the message body was not altered in transit.
What is a DKIM selector?+
A DKIM selector is an arbitrary string that points receiving servers to the specific DNS TXT record containing the public key. For example, with selector "google", the public key is published at "google._domainkey.yourdomain.com". Selectors allow organizations to rotate keys or use multiple email service providers simultaneously.
Should I use 1024-bit or 2048-bit DKIM keys?+
2048-bit RSA keys are modern industry best practice and recommended by Google, Microsoft, and the IETF. 1024-bit keys are considered legacy and susceptible to factoring attacks, though some older DNS hosts with character limits may still require them.
How do I handle character limit errors when publishing 2048-bit DKIM keys?+
A 2048-bit public key string is approximately 450 characters long. DNS TXT records have a 255-character chunk limit per RFC 1035. Most DNS providers (like Cloudflare or Route 53) automatically chunk strings, but on legacy systems you must enclose two space-separated quoted strings within the same TXT record.
Can I have multiple DKIM records for my domain?+
Yes! Unlike SPF (which allows only one TXT record), you can publish as many DKIM records as needed, provided each uses a unique selector name (e.g. s1._domainkey, google._domainkey, k1._domainkey).

Complementary Domain & Email Authentication Tools

Strengthen your client email infrastructure and DNS security perimeter with our free web tools.

🛡️

SPF Record Generator

Generate RFC 7208 compliant SPF TXT records with instant syntax validation.

Open Tool →
🧮

SPF Lookup Calculator & Flattener

Audit the 10-lookup limit and recursively inspect nested include: mechanisms.

Open Tool →
🎨

BIMI Checker & VMC Validator

Audit BIMI records, preview SVG logos, and check VMC certificate readiness.

Open Tool →
✉️

DMARC Policy Generator

Build custom p=reject or p=quarantine policies with aggregate reporting.

Open Tool →