Find out whether DKIM is already signing mail for your domain, or generate a new DNS TXT record from your public key. Everything happens on one page.
The domain that sends your email.
Leave blank to auto-detect all DKIM selectors for your domain.
DNS record name:
your-selector._domainkey.yourdomain.com
Only needed if you want to generate a record.
Your email provider or server admin usually gives you a public key file. If you are generating keys yourself, ask your IT team or hosting provider. The key looks like a long block of random letters and numbers between -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY-----.
# Generate a 2048-bit private key openssl genrsa -out dkim_private.pem 2048 # Extract the public key openssl rsa -pubout -in dkim_private.pem -out dkim_public.pem # View it (copy everything between the markers) cat dkim_public.pem
Paste the content between and including the BEGIN / END lines into the field above.
DKIM adds a digital signature to every outgoing message. When a receiving server sees the signature, it can confirm the mail really came from your domain and that nothing was altered in transit. Without it, your messages are far more likely to be filed as spam or rejected outright.
Gmail and Outlook both check for a valid DKIM signature when deciding where to place your mail. A properly signed domain enjoys better deliverability and a cleaner sender reputation. It is the second pillar of email authentication, working alongside SPF and DMARC to prove who you are to every mailbox provider you contact.
There is a proof of origin angle too. If someone receives an email claiming to be from your domain, your DKIM signature shows whether it genuinely came from you or was spoofed. For compliance, auditing, and brand protection, that single record carries real weight. And because DMARC enforcement depends on DKIM alignment, publishing a key is also the foundation for moving toward a strict DMARC policy later.
Start by entering your domain and clicking Check DNS. The tool scans the common selectors used by major providers, so a record that is already live gets found without you knowing the selector name. If one appears, you are done. The correct selector and record value are shown for reference.
If no record exists and you want to create one, select your email provider to prefill the recommended selector, or leave it blank and let the tool suggest one. Paste your public key from your email service, then click Generate Record. The TXT value you need to publish in DNS appears instantly.
Add that value at the selector shown, wait for propagation, then return and click Check DNS again to confirm the signature is live. The whole workflow takes a couple of minutes and never leaves this page.