FREE TOOL BY WARMY.IO

DKIM Generator & Checker

Q: What is a DKIM selector?

A selector is the name of one key, published at selector._domainkey.yourdomain.com. Selectors let one domain run several keys at once: one for Google Workspace, one for your newsletter platform, one for your help desk.

Q: Should I use a 1024 or 2048-bit key?

Use 2048-bit. Gmail and Yahoo recommend it, and 1024-bit keys are increasingly treated as weak.

Q: Are the keys generated here safe?

Yes. The key pair is created in your browser with the Web Crypto API. The private key never leaves your device and isn't sent to Warmy, so copy it somewhere safe before you close the page.

Q: Most providers give me a DKIM key. Do I need this?

Usually not. If you send through Google Workspace, Microsoft 365 or an email platform, use the key they create, because they also sign your mail with it. The generator is for servers you run yourself, such as Postfix, Exim or a custom MTA, and for rotating keys on those servers.

Q: How do I check my DKIM?

Use the Check tab. Enter your domain and selector, or leave the selector empty and we'll try the 20 most common ones.

Q: Why does my DKIM check fail even though the record exists?

Most often the record is published under a different selector than the one your mail is signed with. Open a message you sent, find the DKIM-Signature header and compare its s= value with the selector you checked. Other causes: the key was cut off at 255 characters when it was pasted into DNS, or signing was never switched on in your provider's admin panel, so the record exists but nothing uses it.

Q: How often should I rotate DKIM keys?

Every 6 to 12 months is a reasonable rhythm, and right away if you think a private key was exposed. Publish the new key under a new selector, switch signing to it, and remove the old record a few days later so mail already in transit still verifies.

Q: How do I set up DKIM in Google Workspace or Microsoft 365?

Both create the key for you. In Google Workspace, generate it in the Admin console, publish the TXT record under the google selector, then click Start authentication. Microsoft 365 uses two CNAME records, selector1 and selector2, and you turn on signing in the Defender portal. Our Google Workspace DKIM guide walks through every screen.

Generate a DKIM key pair and validate any domain's DKIM setup in seconds: the missing piece between your SPF and DMARC records.

✓2048-bit keys
✓Common selector scan
✓Private key stays on your device

4.9/5 on G2Trusted by 7,000+ businesses

Trusted by teams that live in the inbox

7,000+

Businesses warming up with Warmy

4.9/5

Average rating on G2

98%

Average inbox placement reached

24/7

Human deliverability support

How it works

Sign every email with DKIM

01
Generate a key pair
Pick a selector and create a 2048-bit key in your browser.
02
Install the private key
Add it to your mail server, such as Postfix or OpenDKIM.
03
Publish the record
Add the TXT record at selector._domainkey.yourdomain.com.
04
Check it works
Run the checker to confirm receivers can find your key.

How DKIM works and how to read your DKIM check

DKIM adds a cryptographic signature to every message you send. Your mail server signs it with a private key, and receivers fetch the matching public key from DNS to confirm the message came from your domain and wasn't changed on the way. The DKIM checker above finds that public key and tells you whether receivers can use it.

What's inside a DKIM record

The record lives at selector._domainkey.yourdomain.com. The selector is a label you or your provider chose, so one domain can hold several keys, one per sending service. Inside the TXT value, v=DKIM1 sets the version, k=rsa names the key type and p= carries the public key itself. An empty p= means the key was revoked on purpose. You may also see t=y, which marks the key as in testing. Use 2048-bit keys: 1024 bits is the minimum receivers accept, and anything shorter fails.

How to find your DKIM selector

If the checker finds nothing, the record often exists under a selector it didn't try. Google Workspace uses google by default, and Microsoft 365 publishes two CNAME records, selector1 and selector2. Most email platforms set their own. The quickest way to find yours is to open a message you sent, view the original headers and read the s= value in the DKIM-Signature line. Our guide to finding DKIM selectors shows where to look for each major provider.

Why a DKIM check fails

The usual causes are simple. The key was never published, or it was published under a different selector. The DNS host cut a long key at 255 characters instead of splitting it into strings. Signing was never switched on in the provider's admin panel, which is common in Google Workspace, where DKIM is off until you start it (setup steps here). A forwarding service or a footer tool changed the message body after signing. And for DMARC, the d= domain in the signature has to match the domain in your From address, or DKIM passes while DMARC still fails.

When to use the DKIM generator

Most providers create and host the key for you, so you only copy their record into DNS. The DKIM generator is for senders who run their own mail server, such as Postfix with OpenDKIM, or who need to rotate a key. The key pair is created in your browser and the private key never leaves your device. Rotate keys every 6 to 12 months, and publish the new selector before you retire the old one.

Next step after DKIM passes

DKIM is one of three records Gmail and Yahoo expect. Check your policy with the DMARC Checker and your SPF with the SPF Checker. With all three in place, authentication stops holding you back and reputation decides where you land. Warmy builds that reputation with warm-up from real mailboxes and watches your DNS records daily, so a broken key doesn't go unnoticed.

SPF, DKIM and DMARC done? Build the reputation on top. Start a 7-day trial or book a demo.

Get a 7-Day Trial Book a Demo

Why Warmy

Everything Deliverability
In One Platform

One platform, one subscription, one team, no add-ons, no extra vendors.

Scale & people

1M+ real mailboxes - The largest warm-up network — genuine Workspace, Microsoft 365 and consumer inboxes.
A dedicated success manager - A named expert who owns your placement outcomes, not a ticket queue.
24/7 support, VIP channels - Real people any hour, in your own Slack, WhatsApp or Teams channel.
120+ deliverability specialists - The largest team in the category, dedicated to inbox placement.
An in-house research team - Continuous experiments on how Gmail, Outlook and Yahoo filter this month.
Recognised experts - Specialists who advise on sender reputation daily — not generalists.

Technology

Adeline AI co-pilot - Reads your tests, DNS and warm-up data, then tells you what to fix next.
The infrastructure behind other tools - Outreach platforms and ESPs run their warm-up on our API.
One loop: test, warm, fix - Placement tests, warm-up, monitoring and fixes in a single platform.
500K+ US seed accounts - Real inboxes across major, corporate and regional providers — mobile included.
Monthly seed rotation - Aging mailboxes retire automatically, so your data comes from live inboxes.
Automation built in - n8n, Zapier, Make and a documented API — no CSVs, no manual seed files.

Included in every plan

Email verification - Clean lists before you send, so bounces never cost you reputation.
DMARC tracker - SPF, DKIM and DMARC monitoring with the exact record to change.
Deliverability tester - Instant placement, authentication and blacklist check for any sender.
Templates AI optimizer - Your campaign scored and rewritten for the inbox before you send.
Reputation tracker - Domain and IP reputation with blacklist alerts the moment a signal drops.
Google Postmaster built in - Postmaster data beside your warm-up and placement results.
Working-hours warm-up - Natural business-hours sending in the recipient’s time zone.
A robust API - Every feature available over documented endpoints.

No extra vendors, no add-on fees, no separate contracts.

Loved By Thousands Of Marketers Around The World

Over 7,000 Businesses Trust Warmy

FAQ

DKIM
Questions, Answered

What is DKIM?

DKIM adds a digital signature to every email you send. Receivers check it against a public key in your DNS to confirm the message came from your domain and wasn't changed on the way.

What is a DKIM selector?

Should I use a 1024 or 2048-bit key?

Are the keys generated here safe?

Most providers give me a DKIM key. Do I need this?

How do I check my DKIM?

Why does my DKIM check fail even though the record exists?

How often should I rotate DKIM keys?

How do I set up DKIM in Google Workspace or Microsoft 365?

Get started

SPF, DKIM And DMARC Done?
Warmy Builds The Reputation On Top

Get a 7-Day Trial Book a Demo

No Credit Card Required | Cancel Anytime

Keep going

More Free Tools

Everything you need to send emails that look great and land in the inbox.

4.9/5 on G2

Recognized By The People Who Use Us

Award-winning on G2, season after season

A white and teal triangle with black text.

DKIM Generator & Checker

Sign every email with DKIM

Generate a key pair

Install the private key

Publish the record

Check it works