How to Generate a DKIM Key, Choose a Selector and Publish the Record for Reliable Email Delivery

To generate a DKIM key, you create an RSA key pair (2048-bit is the current standard), keep the private key on the server or service that sends your mail, and publish the public key as a TXT record at selector._domainkey.yourdomain.com. You can do this in a browser with our free DKIM record generator, on the command line with OpenSSL, or inside the admin console of Google Workspace or Microsoft 365.

Below we cover each method, selectors, key length, testing, rotation and the Gmail and Yahoo sender rules.

What is a DKIM key pair?

DKIM (DomainKeys Identified Mail) is defined in RFC 6376. It lets a domain take responsibility for a message by attaching a cryptographic signature to it. That signature depends on two mathematically linked keys.

• Private key: stays secret on your mail server, email service provider or cold email platform. It signs selected headers and the body of each outgoing message.
• Public key: published in DNS for anyone to read. Receiving servers fetch it and use it to check the signature.

If the message was changed in transit, or was signed with a key that does not match the published one, verification fails. If you want the background on how signing and verification work in detail, read our article on how DKIM protects your emails.

What does a DKIM signature look like?

Each signed message carries a DKIM-Signature header. A shortened example:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=example.com; s=s2026;
 h=from:to:subject:date:message-id;
 bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=;
 b=AuUoFEfDxTDkHlLXSZEpZj79LICEps6eda7W3deTVFOk...

The two tags that matter most here are d= (the signing domain) and s= (the selector). Together they tell the receiver exactly where to look up the public key.

What is a DKIM selector and how do you choose one?

A selector is a label that lets one domain publish several DKIM keys at the same time. The receiver combines the selector and domain from the signature into a DNS name:

s2026._domainkey.example.com

That is why one domain can hold separate keys for Google Workspace, a newsletter platform and a cold email tool without conflicts.

Selector naming tips

• Use letters, numbers and hyphens only, as with any DNS label.
• Make it descriptive and dated so rotation is easy, for example s202610 or mkt2026.
• Do not reuse a selector for a new key. Publish the new key under a new selector instead.
• Accept the provider’s fixed selector when it has one. Google Workspace uses google by default and Microsoft 365 uses selector1 and selector2.

To find the selector a sender already uses, open a received message, view the original headers and read the s= value in the DKIM-Signature line.

Which DKIM key length should you use: 1024 or 2048 bit?

Use 2048 bit. RFC 8301 says signers must use RSA keys of at least 1024 bits and should use at least 2048 bits, and it retired the old rsa-sha1 algorithm. Google also recommends a 2048-bit key in its DKIM setup instructions. Only fall back to 1024 bit if your DNS host truly cannot store a longer TXT value.

Option	Security	DNS record size	Receiver support	When to use
RSA 1024-bit	Minimum allowed, considered weak today	Fits in one 255-character TXT string	Universal	Only when your DNS host cannot handle longer records
RSA 2048-bit	Recommended standard	About 400 characters, split into multiple strings	Universal	Default choice for every domain
RSA 4096-bit	Stronger than needed for most	Very long, some DNS panels reject it	Allowed by RFC 8301, but less tested	Rarely worth the extra complexity
Ed25519 (RFC 8463)	Strong with a short key	Very short	Not supported everywhere	Only as a second signature alongside RSA

Why 2048-bit records need splitting

A single string inside a DNS TXT record can hold at most 255 characters. A 2048-bit public key is longer than that, so the value must be stored as two or more quoted strings in the same record. Most modern DNS dashboards, such as Cloudflare, split it for you. In a BIND zone file you split it manually:

s2026._domainkey  IN  TXT  ( "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
                             "...remainder of the key...IDAQAB" )

Receivers join the strings back together with no spaces, so the key still validates.

How to generate a DKIM key: four methods compared

Which method you use depends on who sends your mail. If a hosted provider sends it, let the provider generate the key so it can store the private half. If you run your own mail server or an SMTP relay that asks you to upload a key, generate it yourself.

Method	Who keeps the private key	Best for	Skill needed
LeadCanal DKIM record generator	You, to upload to your server or tool	Self-hosted mail, Postfix, SMTP relays, quick setups	Low
OpenSSL or opendkim-genkey	You, created locally	Sysadmins who want keys created offline	Medium
Google Workspace Admin console	Google	Domains using Gmail for business	Low
Microsoft Defender portal or PowerShell	Microsoft	Domains using Microsoft 365 or Exchange Online	Low to medium

Method 1: Use the LeadCanal DKIM record generator

1. Open the free DKIM generator.
2. Enter your domain and a selector, such as s2026.
3. Choose 2048 bit as the key length.
4. Copy the private key into your mail server or sending platform and store a secure backup.
5. Copy the public TXT record value and host name for your DNS provider.

Treat the private key like a password. Do not paste it into chat tools, tickets or shared documents.

Method 2: Generate a DKIM key with OpenSSL

If you prefer to create the key on your own machine, OpenSSL ships with most Linux and macOS systems.

1. Create a 2048-bit private key:

   openssl genrsa -out s2026.private.pem 2048

2. Extract the public key as a single base64 line for DNS:

   openssl rsa -in s2026.private.pem -pubout -outform der | openssl base64 -A

3. Build the TXT value by placing that output after p=:

   v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

4. Restrict file permissions on the private key, for example chmod 600 s2026.private.pem.

On servers that run OpenDKIM, the bundled tool does all of this in one command and writes a ready-made zone file entry:

opendkim-genkey -b 2048 -d example.com -s s2026

It produces s2026.private (the signing key) and s2026.txt (the DNS record).

Method 3: Generate DKIM for Google Workspace

Google holds the private key, so you only publish what it gives you. The official steps are in Google’s DKIM setup guide.

1. Sign in to the Google Admin console as a super administrator.
2. Go to Apps, then Google Workspace, then Gmail, then Authenticate email.
3. Select the domain and click Generate new record.
4. Keep the 2048-bit key length and the default google selector unless you need another prefix.
5. Copy the TXT record name and value into your DNS host.
6. Wait for DNS to update, then return and click Start authentication.

Until you do this, Google signs your mail with a default key for its own domain, which does not align with your From address for DMARC purposes.

Method 4: Generate DKIM for Microsoft 365

Microsoft 365 uses two selectors, selector1 and selector2, and asks you to publish them as CNAME records that point to keys Microsoft hosts. That design lets Microsoft rotate keys for you.

1. Open the Microsoft Defender portal and go to Email and collaboration, then Policies and rules, then Threat policies, then Email authentication settings, then DKIM.
2. Select your custom domain to see the two CNAME records it needs.
3. Create both CNAME records at your DNS host exactly as shown.
4. Return to the portal and turn on signing for the domain.

Admins who prefer PowerShell can use Exchange Online commands such as New-DkimSigningConfig -DomainName example.com -KeySize 2048 -Enabled $false, then enable signing after the CNAME records resolve.

How to publish the DKIM record in DNS

Once you have the public key, adding it to DNS takes a few minutes. These steps apply to Cloudflare, GoDaddy, Namecheap, Route 53 and most other hosts.

1. Log in to the DNS provider for your domain. Confirm where DNS is hosted with our DNS lookup tool if you are unsure.
2. Create a new record of type TXT (or CNAME for Microsoft 365 and some ESPs).
3. Set the host or name to s2026._domainkey. Many panels add your domain automatically, so do not type it twice.
4. Paste the value, for example v=DKIM1; k=rsa; p=MIIBIjANBg...IDAQAB, with no line breaks or stray quotes.
5. Leave TTL at the default or set it to one hour.
6. Save, then wait for propagation. Most changes appear within minutes, but some take longer.
7. Enable DKIM signing in your mail platform for that selector.

Need the record built in the exact format your host expects? Our DKIM record creator outputs the host name and value ready to paste.

How do you test that your DKIM key works?

Run two checks: a DNS check and a live message check.

• DNS check: enter your domain and selector in the LeadCanal DKIM checker. It confirms the record exists, parses the tags and reports the key length.
• Message check: send an email to a Gmail or Outlook mailbox, open the original message and look for dkim=pass with header.d=yourdomain.com and the selector you created.
• Full domain check: run the domain health checker to review SPF, DKIM, DMARC and MX together.

From a terminal, you can also query the record directly with dig TXT s2026._domainkey.example.com +short.

Common DKIM key errors and how to fix them

“No key for signature” or “key not found in DNS”

The receiver could not find a record at the selector and domain in the signature. Check that the host name is correct, that your DNS panel did not append the domain twice (for example s2026._domainkey.example.com.example.com) and that the selector in your platform matches the one in DNS.

“Body hash did not verify”

The message changed after signing. Mailing lists, footers added by gateways, or security appliances that rewrite links are the usual causes. Sign as the last step before delivery and use relaxed canonicalization.

“Signature verification failed” or bad signature

The published public key does not match the private key in use. This often happens when a key is regenerated but DNS still holds the old value. Generate a fresh pair and publish both halves together.

Broken or truncated 2048-bit record

Extra spaces, line breaks, missing characters or doubled quotes break the key. Split long values into strings under 255 characters and verify the result with the DKIM checker.

Key in testing mode

A record with t=y tells receivers the domain is testing DKIM. Remove that flag once you have confirmed everything passes.

DKIM passes but DMARC fails

The signing domain in d= does not match your From domain. This is common when an ESP signs with its own domain. Set up custom DKIM for your domain in that platform. Our guide on why DMARC fails covers alignment in depth.

How often should you rotate DKIM keys?

Rotating keys limits the damage if a private key leaks and keeps old weak keys out of service. A common practice is to rotate every six to twelve months, and immediately if you suspect the key is exposed or a vendor relationship ends.

1. Generate a new key pair under a new selector, for example s202704.
2. Publish the new public key in DNS alongside the old one.
3. Switch your platform to sign with the new selector.
4. Keep the old record live for several days so messages still in transit can be verified.
5. Revoke the old key by publishing an empty p= value, then delete the record later.

Google Workspace lets you generate a new record from the same Authenticate email page. Microsoft 365 rotates between its two selectors, and you can trigger a rotation or upgrade an old 1024-bit key with Rotate-DkimSigningConfig -Identity example.com -KeySize 2048.

How DKIM fits with SPF, DMARC and the Gmail and Yahoo rules

DKIM is one of three DNS records that work together. If you are still deciding which does what, our comparison of SPF vs DKIM vs DMARC is a good primer.

• SPF lists the servers allowed to send for your domain. Build one with our SPF record generator or follow our walkthrough on creating an SPF record.
• DKIM proves the message was signed by your domain and not altered.
• DMARC tells receivers what to do when SPF and DKIM fail to align with the From domain, and sends you reports. Create one with our DMARC record generator and verify it with the DMARC checker.

What Gmail and Yahoo require

Since February 2024, Gmail and Yahoo require authentication from senders. Under Google’s sender guidelines, every sender must set up SPF or DKIM. Bulk senders, defined by Google as those sending more than 5,000 messages a day to Gmail accounts, must have:

• SPF and DKIM both configured for the sending domain.
• A DMARC record, with a policy of at least p=none.
• The From domain aligned with either the SPF or the DKIM domain.
• One-click unsubscribe for marketing messages and a spam rate kept below 0.3%.

Yahoo’s sender best practices set out matching requirements. Because DKIM survives forwarding better than SPF, a correctly aligned DKIM signature is often what keeps DMARC passing.

For a step-by-step DMARC rollout after your DKIM key is live, see how to set up DMARC for your domain.

DKIM key setup for cold email domains

If you send outreach from secondary domains, every domain and every sending platform needs its own DKIM key.

• Set up DKIM before warming up any mailbox, not after.
• Use 2048-bit keys on every domain, including new lookalike domains.
• Record each selector, platform and creation date in a simple sheet so rotation is easy.
• Recheck all domains monthly with the domain health checker, because DNS changes at registrars can silently remove records.

Our article on DNS and email authentication for cold email shows how all the records fit together across many domains. If you would rather hand the work off, the LeadCanal email deliverability service and private email server setup cover DKIM, SPF, DMARC and inbox placement for you.

Frequently asked questions

What is a DKIM key?

A DKIM key is a cryptographic key pair. The private key signs outgoing email, and the public key, published in DNS, lets receivers verify that signature and confirm the message was not altered.

How do I generate a DKIM key pair for free?

Use the LeadCanal DKIM record generator in your browser, or run openssl genrsa -out dkim.pem 2048 and extract the public key with OpenSSL. Google Workspace and Microsoft 365 generate keys for free inside their admin tools.

Should I use a 1024 or 2048 bit DKIM key?

Use 2048 bit. RFC 8301 recommends it and Google advises it. Use 1024 bit only if your DNS provider cannot store records longer than 255 characters.

Can I have more than one DKIM key on a domain?

Yes. Each key uses its own selector, so you can publish separate keys for Google Workspace, a marketing platform and a cold email tool on the same domain.

Is a DKIM record a TXT or CNAME record?

The public key itself is stored in a TXT record. Some providers, including Microsoft 365 and several ESPs, ask you to publish a CNAME that points to a TXT record they host, so they can rotate keys for you.

Do DKIM keys expire?

No. A DKIM record stays valid until you change or remove it. You should still rotate keys periodically and revoke old ones by publishing an empty p= tag.

Where is the DKIM private key stored?

With hosted providers such as Google and Microsoft, the provider stores it. On a self-managed server, it sits in a protected file that your signing software, such as OpenDKIM, reads.

How long does DKIM take to start working?

Once DNS updates, signing works immediately. DNS changes usually appear within minutes to a few hours, and Google notes that DNS changes can take up to 48 hours to take effect.

Conclusion: key takeaways

• Generate a 2048-bit RSA key pair and keep the private key secret.
• Pick a clear, dated selector and publish the public key at selector._domainkey.yourdomain.com.
• Let Google Workspace or Microsoft 365 create keys when they send your mail. Use our generator or OpenSSL for your own servers.
• Test with the DKIM record checker and confirm dkim=pass in real message headers.
• Rotate keys on a schedule, using a new selector each time.
• Pair DKIM with SPF and DMARC to meet Gmail and Yahoo sender requirements.

Ready to start? Create your key and TXT record now with the LeadCanal DKIM generator, or ask our team for a quote on full authentication and deliverability setup.

Editorial policy

LeadCanal publishes practical guides on email deliverability, cold email and B2B data. Every article is written to solve a real problem our readers face, reviewed for technical accuracy before publishing and updated when standards, provider settings or mailbox rules change.

Content transparency

This article was researched with keyword data to understand what readers search for, then checked against official documentation, including RFC 6376, RFC 8301, Google Workspace help pages and Yahoo sender guidance. LeadCanal offers the free DKIM, SPF, DMARC and domain health tools mentioned here, and we link to them where they help you complete a step.

About the author

This guide was written by the LeadCanal team. We build verified B2B contact lists and run cold email infrastructure every day, which means setting up DKIM, SPF and DMARC across many sending domains and mailboxes. The advice here comes from that hands-on work and from the published standards behind it.