--- title: "How to Generate a DKIM Record (Step by Step) | AutoSPF" description: "You don" image: "https://autospf.com/images/og-default.png" canonical: "https://autospf.com/dkim/how-to-generate-a-dkim-record/" --- # How to Generate a DKIM Record You don't hand-write DKIM keys - your mail provider generates the public/private key pair when you enable DKIM. You publish the public key it gives you as a TXT record at the provider's chosen selector, then verify it resolves. This guide is part of our complete guide to [DKIM](/dkim/). Related: [the DKIM record](/dkim/dkim-record/) and [the DKIM selector](/dkim/dkim-selector/). **You don’t hand-write DKIM keys — your mail provider generates the public/private key pair for you. You then publish the public key in DNS as a TXT record at the selector host your provider chooses, and the provider keeps the private key to sign your outgoing mail.** That single publish-and-verify loop is all “generating a DKIM record” really means. ## Why you generate DKIM in your provider, not by hand DKIM works with a matched pair of cryptographic keys. The **private key** stays inside your sending platform and signs every outbound message; the **public key** goes into DNS so receiving servers can verify that signature. Because the private key must live securely inside the system that actually sends your mail, your provider is the only place that can generate the pair correctly. It creates both keys, stores the private half where its signing engine can reach it, and hands you the public half to publish. That’s why there’s no real “DKIM generator” step you do yourself. Enabling DKIM in your console does the generation; you just publish the result. Advanced users running their own mail server can generate a key pair manually with `openssl` (for example `openssl genrsa` plus a matching public-key export), but unless you operate your own MTA, stick to the provider path — it’s faster, less error-prone, and keeps the private key where it belongs. ## Step-by-step: generate and publish DKIM 1. **Enable DKIM (email authentication) in your provider console.** Look for a “DKIM,” “email authentication,” or “domain authentication” setting for your sending domain. Turning it on triggers key generation. 2. **Read the output: a public key plus a [selector](/dkim/dkim-selector/) host.** The provider gives you a public key and the exact hostname (the selector, like `s1._domainkey.yourdomain.com`) where it must be published. 3. **Publish the TXT record in your DNS.** Add a TXT (or sometimes CNAME) record at that selector host with the value your provider supplied. See [the DKIM record](/dkim/dkim-record/) for the exact format, tags, and how the value is structured. 4. **Verify with the free [DKIM lookup tool](/tools/dkim-lookup/).** Enter your domain and selector to confirm the public key is live and readable in DNS. DNS changes can take a little time to propagate, so re-check if it isn’t found immediately. 5. **Confirm mail is being signed.** Send a test message and inspect the headers (or your provider’s dashboard) for a `DKIM-Signature` header and a `dkim=pass` result. That confirms the private key is signing and the public key verifies. ## Where to generate DKIM in common providers | Provider | Where to generate DKIM | | -------------------------------- | --------------------------------------------------------------------------------------------------------------- | | Google Workspace | Admin console > Apps > Google Workspace > Gmail > Authenticate email | | Microsoft 365 | Microsoft Defender portal > Email & collaboration > Policies > Email authentication settings > DKIM | | ESPs (SendGrid, Mailchimp, etc.) | Auto-provided during “domain authentication” — the platform generates keys and gives you the records to publish | For Google Workspace and Microsoft 365 you generate the key, then publish the record they show you. For most ESPs, domain authentication bundles DKIM (often alongside SPF and a tracking domain), so you simply add the records they list. ## Key length: 1024 vs 2048 When your provider offers a choice, pick **2048-bit** keys. They’re meaningfully stronger than 1024-bit and are now the recommended default across the industry. The one caveat is that a 2048-bit public key is longer than a 1024-bit one, and some older DNS interfaces struggle with TXT records over 255 characters — they may need the value split into multiple quoted strings. Most modern DNS hosts handle this automatically. If your provider only offers 1024-bit, that still works, but move to 2048-bit when you can. ## Keep it healthy DKIM isn’t set-and-forget. Rotate your keys periodically — many providers now rotate automatically — so a single compromised key can’t be abused indefinitely. And remember that DKIM is one leg of a three-part stack: a valid [SPF record](/tools/spf-checker/), DKIM, and DMARC work together to prove your mail is legitimate. If any leg is broken, deliverability suffers. On the SPF side, watch the 10-lookup limit that causes SPF to fail silently once your record references too many services. [AutoSPF](/) flattens and maintains your SPF record so it stays under that limit automatically, letting you keep DKIM and DMARC focused on the signing and policy side without SPF quietly breaking underneath them. ## Frequently Asked Questions ### How do I generate a DKIM record? You generate a DKIM record by enabling DKIM or email authentication inside your mail provider’s console. The provider creates the key pair and gives you a public key plus a selector host. You then publish that public key as a TXT record in your DNS and verify it, which completes the setup. ### Do I need a DKIM generator tool? Usually no. Your mail provider generates the key pair for you when you enable DKIM, so a standalone generator is redundant and can even be risky if it exposes the private key. Only self-hosted mail servers need manual generation, typically with openssl. For everyone else, the provider console is the correct and safest path. ### What key length should I use for DKIM? Use 2048-bit keys whenever your provider offers the choice, as they are stronger than 1024-bit and are the current industry recommendation. The only downside is a longer DNS value that some legacy DNS interfaces may need split across multiple strings. Most modern DNS hosts handle 2048-bit records without any extra steps. ### Where do I put the DKIM record after generating it? You publish it in your domain’s DNS as a TXT record at the exact selector host your provider specifies, such as `selector._domainkey.yourdomain.com`. The record value is the public key your provider supplied. After adding it, verify with a DKIM lookup tool to confirm it is live and readable before relying on it. Rated 5/5 on G2 · Trusted since 2018 ## Trusted by 50,000+ domains ### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product" > It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. PJ Peter J. President · Small-Business (50 or fewer emp.) ### "Helped us go beyond capacity" > AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. VU Verified User Financial Services · Mid-Market (51-1000 emp.) ### "Great service and great support" > AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup. GF Greg F. Mid-Market (51-1000 emp.) [Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"How do I generate a DKIM record?","acceptedAnswer":{"@type":"Answer","text":"You generate a DKIM record by enabling DKIM or email authentication inside your mail provider's console. The provider creates the key pair and gives you a public key plus a selector host. You then publish that public key as a TXT record in your DNS and verify it, which completes the setup."}},{"@type":"Question","name":"Do I need a DKIM generator tool?","acceptedAnswer":{"@type":"Answer","text":"Usually no. Your mail provider generates the key pair for you when you enable DKIM, so a standalone generator is redundant and can even be risky if it exposes the private key. Only self-hosted mail servers need manual generation, typically with openssl. For everyone else, the provider console is the correct and safest path."}},{"@type":"Question","name":"What key length should I use for DKIM?","acceptedAnswer":{"@type":"Answer","text":"Use 2048-bit keys whenever your provider offers the choice, as they are stronger than 1024-bit and are the current industry recommendation. The only downside is a longer DNS value that some legacy DNS interfaces may need split across multiple strings. Most modern DNS hosts handle 2048-bit records without any extra steps."}},{"@type":"Question","name":"Where do I put the DKIM record after generating it?","acceptedAnswer":{"@type":"Answer","text":"You publish it in your domain's DNS as a TXT record at the exact selector host your provider specifies, such as `selector._domainkey.yourdomain.com`. The record value is the public key your provider supplied. After adding it, verify with a DKIM lookup tool to confirm it is live and readable before relying on it."}}]} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"DKIM","item":"https://autospf.com/dkim/"},{"@type":"ListItem","position":3,"name":"Generate a DKIM Record","item":"https://autospf.com/dkim/how-to-generate-a-dkim-record/"}]} ``` ```json {"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Greg F."},"datePublished":"2023-07-26","reviewBody":"AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup.","name":"Great service and great support","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]} ```