Where is my public key sent?

Nowhere. The record is formatted locally in your browser. The public key is, by design, public; you publish it in DNS.

RSA 2048 is universally supported. Ed25519 (RFC 8463) is smaller and faster but not all receivers honor it yet; publish both selectors if you want Ed25519 without losing compatibility.

What selector should I use?

Any token. A common convention is the year and month (202405) so you can rotate keys by publishing a new selector and switching your signer over.

Why is my DKIM signature failing?

Most often: key mismatch (selector points at the wrong key), header canonicalization issues, or a mail relay rewriting headers after signing. The DMARC report shows which header(s) failed.

dkim · txt record · rsa · ed25519

Build a DKIM DNS record

Compose the _domainkey TXT record from your selector, domain and public key. Headers are stripped and key type tagged automatically.

DKIM Record Builder

Selector

mail

subdomain

Key type

rsa

default

Key length

0 B

paste pem

Record

18 B

18 chars

DNS hostmail._domainkey.example.com

input · key

SelectorDomainKey type

Public key (PEM — headers and whitespace will be stripped)

output · txt record

mail._domainkey.example.com

v=DKIM1; k=rsa; p=

Quick Start

How to publish DKIM

DKIM signs outgoing mail so receivers can verify authenticity. The selector lets you rotate keys without downtime.

01
Pick a selector
A short label like "mail" or "google2024". Use a new one for each key rotation.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
selectorIANAregistryofflinelive
selector · querymail · IANA
```
mail._domainkey.example.com
```
loaded · IANA bundlespec · ready
02
Paste the public key
PEM with BEGIN/END lines. Headers and whitespace are stripped automatically.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
keyRFC 9110canonicalspec-compliantlive
key · optionsstripped · live
```
MIIBIjAN…
```
options applied · livecanonical
03
Choose key type
RSA is universally supported; Ed25519 is shorter and modern.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
algvalidationlintpitfallslive
alg · looked uprsa · ready
```
k=rsa
```
result · livevalidated
04
Add the TXT record
In your DNS, create a TXT at selector._domainkey with the record value.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
dnsclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
v=DKIM1; k=rsa; p=…
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to publish DKIM

Email authentication, deliverability, anti-spoof.

New sender setup

Configure DKIM before sending production mail. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Key rotation

Rotate keys yearly with a fresh selector. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Provider onboarding

Google, Mailgun, SendGrid all need DKIM TXT records. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Anti-spoof

DKIM + DMARC stop attackers from impersonating your domain. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Deliverability

Authenticated mail reaches inboxes; unsigned often hits spam. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

Multi-domain

Each sending domain needs its own selector record. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

Where does the private key live?

On your mail server / sending provider. Only the public key goes in DNS as a TXT record.

RSA or Ed25519?

RSA 2048 is universal. Ed25519 is faster and shorter but a handful of receivers still don't support it — publish both selectors during transition.

TXT length limits?

DNS TXT strings cap at 255 chars; many providers split long RSA keys into multiple quoted strings concatenated by the resolver.

How do I rotate keys?

Add a new selector, switch your signer to use it, then remove the old TXT record after a week.

Is anything sent to a server?

No — record assembly runs locally in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!