Truvo Free Tools

DKIM record generator

DKIM signs outbound mail with a private key and lets receivers verify the signature against a public key you publish in DNS. This generator creates the key pair in your browser and outputs the public TXT record for selector._domainkey.yourdomain.com. The private key stays on your device: it is never sent to Truvo or to anyone else.

SOC 2 CC6.1SOC 2 CC6.7SOC 2 CC7.2ISO 27001 A.5.14ISO 27001 A.8.20
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the DKIM record generator works

The key pair is generated by your browser. The private key is shown to you and stays on your device, and only the public half belongs in DNS.

01

Generate the key pair

The browser creates an RSA key pair locally. The private key appears on screen for you to copy into your mail server or sending platform. It is not transmitted anywhere, so close the tab only after you have stored it somewhere safe.

02

Name the selector

A selector is a label that lets one domain publish several DKIM keys at once, which is what makes key rotation and multiple senders possible. RFC 6376 places the public key at ._domainkey., so a selector of s1 gives s1._domainkey.example.com.

03

Publish the public record

Copy the generated TXT record, which carries v=DKIM1, the key type and the base64 public key in the p tag, and publish it at the selector name. Then configure your mail platform to sign with the private key and the same selector, and send a test message to confirm the signature verifies.

Setting up mail authentication? We do that work.

Truvo's security engineers set the policy, fix the senders that break when it tightens, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the work.

Contact us

  • DKIM signing and rotation

  • SPF under 10 lookups

  • DMARC to reject

  • Report monitoring

  • Audit evidence

  • Fixed-price scope

DKIM record generator: frequently asked questions

In your browser, on your device. The key pair is created locally and the private key is never transmitted to Truvo or to any other server. Copy it into your mail server or sending platform and store it the way you store other secrets. Truvo cannot recover it for you, because Truvo never has it.

The public key goes in DNS, as a TXT record at ._domainkey., carrying v=DKIM1 and the key in the p tag. The private key goes on the system that signs your outbound mail, and nowhere else. Publishing the private key would let anyone sign mail as your domain.

A selector is a label in the DNS name that identifies one key among several. RFC 6376 puts the public key at ._domainkey., and the signature in each message names the selector it used. That is how a domain can run one key for its mail server and another for a marketing platform, and how you rotate a key without an outage: publish the new selector, switch signing to it, then retire the old one.

Many hosted mail and marketing platforms generate the key pair on their side and give you the DNS record to publish, which is a reasonable arrangement because they hold the key that signs your mail anyway. Use this generator when you run the signing system yourself, or when a platform asks you to bring your own key.

SPF authorizes sending hosts, DKIM authenticates the message itself with a signature that survives forwarding, and DMARC checks that one of them passes and aligns with the domain in the From header. A DMARC policy of reject depends on at least one of the two passing for every legitimate message, which is why DKIM is usually in place before the policy tightens.