How to use it
- Generate a key pair in your mail server or copy the public key from your email provider’s DKIM settings.
- Enter the selector the server signs with and your domain.
- Paste the public key. PEM blocks, bare Base64 and old records (
v=DKIM1; … p=…) all work. - Copy the host name and the TXT value into your DNS panel, or the zone-file line into a BIND zone.
How it works
The record follows RFC 6376: v=DKIM1 comes first, then k= with the key type and p= with the key in Base64. Optional tags are h=sha256 (accept only SHA-256 signatures) and t= with the flags y (testing) and s (the i= domain of a signature must equal d=, no subdomains).
The key is decoded and its type read from the DER structure:
- RSA: a SubjectPublicKeyInfo key (the PEM that starts with
MIIB…) is used as it is. A PKCS#1 key (BEGIN RSA PUBLIC KEY) is wrapped into SubjectPublicKeyInfo, the form DKIM records normally carry. The size is the modulus length. RFC 8301 says signers must use at least 1024 bits and should use at least 2048, so shorter keys are refused and 1024-bit keys get a warning. - Ed25519: RFC 8463 puts the raw 32-byte key into
p=, so a SubjectPublicKeyInfo block is reduced to those 32 bytes.
For the zone file the value is cut into strings of 255 characters, because one TXT string holds at most 255 bytes.
Example
With the selector mail, the domain example.com and the 2048-bit RSA key shown in the form, the record is:
- Host name:
mail._domainkey.example.com - Value:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…IDAQAB— 410 characters. - Zone file: two strings, 255 + 155 characters.
Tips
- Check the record after publishing:
dig TXT mail._domainkey.example.com +shortshould print the value. - Keep the old selector published for a few days when you rotate keys, so messages signed before the switch still verify.
- DKIM works best together with SPF and a DMARC policy.