DKIM record generator: how do you build a selector._domainkey TXT record?

Paste the selector, domain and the PUBLIC key you already have below, and this tool assembles the exact selector._domainkey.<domain> TXT record string as you type, entirely in your browser — nothing you enter, including the key itself, is sent to AdminKit or anywhere else. It only formats a record from a key you provide: it never generates a key pair and never handles a private key. Once you are happy with the result, publish it in your DNS, then confirm it took effect with AdminKit’s live DKIM check, which queries DNS for real.

What does a DKIM record actually need?

DKIM, defined in RFC 6376, publishes a signing key as a TXT record at selector._domainkey.<domain>. Its tags, registered in IANA’s DKIM-Signature Tag Specifications, are:

• v=DKIM1 — the fixed version tag, always first.
• k= — the key algorithm: rsa (the near-universal default) or ed25519.
• p= — required, the base64-encoded public key. An empty value is a deliberate revocation (see the FAQ below).
• h= — optional, the colon-separated hash algorithms a verifier may accept (sha1, sha256); omitted, any algorithm is acceptable.
• s= — optional, the colon-separated service types this key applies to, e.g. email.
• t= — optional, colon-separated flags: y marks the selector “testing,” s restricts signing to exactly this domain, not its subdomains.
• n= — optional, a human-readable note for administrators; verifiers never interpret it.

Why do you need a selector, and what happens with an empty key?

A domain can publish many DKIM keys at once, one per sending service, each under its own selector label — RFC 6376 §3.1 defines no DNS record that lists a domain’s active selectors, so the selector has to come from whoever configured mail sending (usually shown in that provider’s admin panel). Leaving the public key field blank here builds a record with an empty p=, which RFC 6376 §3.6.1 defines as a deliberately revoked key, not a broken one — the expected way to retire a selector when rotating keys.

Limits

• This tool only builds the record text from a public key you provide. It never generates a key pair, never sees or stores a private key, never queries DNS, and never publishes anything — you still have to add the record to your own DNS and confirm it with a live check.
• It validates the selector and domain syntax and strips PEM armor down to raw base64 for p=, but it does not parse the key’s actual cryptographic contents or confirm it is really an RSA or Ed25519 public key — for that, inspect the key with openssl rsa -pubin -text -noout (or the equivalent for Ed25519) before pasting it in.

If you don’t have a key pair yet, generate one offline with OpenSSL — see openssl-rsa(1) for the full -pubout option this tool’s “next step” panel above walks through — and keep the private key file on your mail server only. See SPF, DKIM and DMARC explained for how DKIM fits together with the other two mail authentication records, and AdminKit’s live DKIM check and SPF check once your records are published.