DMARCdrift
ProductPricingDocsBlogToolsSign inGet started
Sign in
← All toolsDNS record builder

DKIM Key Formatter

Paste your public key to get a properly formatted DKIM DNS TXT record. 2048-bit keys are split automatically. Runs in your browser.

Paste a public key above to generate the TXT record.

Runs in your browser. Key material is never sent to our servers. Monitor DKIM alignment across your senders.

See plans →

What is a DKIM record?

A DKIM record is a DNS TXT record published at selector._domainkey.yourdomain.com that contains your public key. When you send mail, your mail server signs each message with the corresponding private key. Receiving servers fetch the public key from DNS and use it to verify the signature, proving the message came from your domain and wasn't tampered with in transit. Without DKIM, DMARC alignment depends entirely on SPF, which breaks when mail is forwarded.

Why 2048-bit keys need to be split

DNS TXT records consist of one or more strings, each limited to 255 bytes. A 2048-bit RSA public key encoded in base64 is roughly 392 characters, so the complete DKIM record value exceeds that limit. RFC 6376 allows splitting across multiple quoted strings within a single TXT record. DNS resolvers concatenate the strings at query time. This tool does the split automatically so you get a record value you can paste directly into your DNS provider.

Frequently asked questions

What's the difference between a DKIM generator and a DKIM checker?
A generator creates the DNS record you need to publish. A checker verifies a record you've already published is valid and reachable. Use this tool to create it, then verify with the SPF + DKIM + DMARC checker once the record propagates.
Do I need DKIM if I already have SPF?
Yes. DMARC requires alignment on either SPF or DKIM. SPF breaks when mail is forwarded. Mailing lists, auto-forwards, and some ESP setups cause SPF to fail even for legitimate mail. DKIM survives forwarding because it signs the message headers, not the envelope. For any sending setup with forwarding in the chain, DKIM is the only reliable path to DMARC alignment.
What selector name should I use?
Your mail provider usually specifies one. If you're configuring your own, anything works — s1, mail, dkim, or a year like 2026 are all fine. You can publish multiple selectors simultaneously to cover different sending services.
My DKIM record is too long for my DNS provider, what do I do?
DNS TXT records are limited to 255 characters per string. Long RSA-2048 keys need to be split into two strings. This tool formats the split automatically. If your DNS provider still rejects it, look for a “multi-string” or “quoted strings” option in their interface, Route 53, Cloudflare, and most modern providers support this.

Publishing is one step. Knowing it works is another.

After publishing your DKIM record, verify your full SPF + DKIM + DMARC setup to confirm alignment is passing end to end.

DMARCdrift shows you which of your senders are successfully signing with DKIM and whether alignment is passing in your DMARC aggregate reports.

Get started free →

Monitor DKIM selectors and get alerted to key changes.

See plans →