Skip to content
AdminToolsSmall tools. Clear answers.

EMAIL / LOCAL SIGNING KEYS

DKIM Generator

Create a signing key and public DNS TXT record locally. Check the generated pair or inspect a pasted public record offline, without querying DNS or sending keys to a server.

Signing key settings

Use ASCII DNS labels, or punycode names, without a URL or path. Select a new selector when rotating a key. Ed25519 needs support in your mail signer and recipients’ software.

Choose a domain, selector, and algorithm.

Check a public DKIM record offline

This checks supported tags, key format and key size. Tag names and known values are case-sensitive. Omit k= to use its RSA default; an explicit empty k= is invalid. An empty p= revokes a selector. It does not fetch DNS, validate an email signature, or prove ownership of the signing domain.

How to publish a signing-key record

Copy the TXT value to the displayed selector._domainkey.domain owner name in your DNS provider. The quoted zone-file form splits long values into strings of at most 255 bytes; these strings belong to one TXT record and concatenate without added spaces. Some DNS panels expect the unquoted value or a relative owner name. Install the private PEM in your mail signer and configure the same selector and signing domain.

Understand the result

RSA records contain SPKI DER public-key bytes; Ed25519 records contain exactly 32 raw public-key bytes. The offline self-check imports the published record and verifies a locally signed test message using the selected algorithm. It checks that the public record matches the private key, not that an actual email message or DNS deployment is valid. To inspect publication, open DNS Toolbox and enter the owner name yourself; live lookups require verification.

Limits and privacy

Use RSA 2048 or 3072 for broad compatibility. Ed25519 can require newer signing and verification software and current browser support. Private keys are unencrypted PKCS#8 PEM; confirm your signer’s key format and protect the file permissions. Keys stay in page memory and are never stored, sent to an API, or placed in URLs. Input changes, Clear and leaving the page remove key references and visible material. JavaScript cannot guarantee erasure of all browser memory or files already downloaded. Offline record checks support RSA SPKI, raw Ed25519, and plain or unescaped quoted ASCII TXT values.

DKIM specification · Ed25519 DKIM signing

Local tools run in this browser. Network checks use this service.