What is a DKIM selector?

A selector is a label that lets a domain publish multiple DKIM keys at once (for different providers or for key rotation). The public key lives at selector._domainkey.yourdomain, and outgoing signatures reference the same selector so receivers know which key to fetch.

Does this tool generate the key pair?

No. The private/public key pair is created by your mail server or email provider (or with openssl). This tool only formats the public key and options into the correct DNS TXT record. Paste the public key your signer produced.

Why is my RSA record longer than 255 characters?

An RSA-2048 public key alone is around 216 base64 characters, and with the tag overhead the full record exceeds the 255-byte single-string TXT limit. DNS handles this by splitting the value into multiple quoted strings, which most DNS control panels do automatically when you paste the full value.

Should I use RSA or Ed25519?

RSA is universally supported and the safe default. Ed25519 produces a much shorter key and signature and is more modern, but not all receivers verify it yet. A common approach is to publish both with different selectors so older receivers fall back to RSA.

What does the test-mode flag (t=y) do?

t=y tells receivers you are still testing DKIM, so they should not treat a verification failure as meaningful. It is useful during initial setup but must be removed once you have confirmed signatures verify, or it weakens your DMARC enforcement.

DKIM Record Builder — Gera Tools

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to your outgoing email and publishes the matching public key in DNS so receivers can verify nothing was tampered with and the message really came from your domain. This builder formats that public-key TXT record correctly.

How it works

Your mail server signs each message with a private key it keeps secret. The public key half is published as a DNS TXT record at a special hostname:

<selector>._domainkey.<your-domain>

The record value is a list of semicolon-separated tags. The builder assembles them in conventional order:

v=DKIM1 — version, always first.
k=rsa or k=ed25519 — the key algorithm.
h=sha256 — permitted hash algorithms (RSA only; omitted when you allow all).
t=... — optional flags: y for test mode, s to forbid subdomain reuse.
s=email — restrict the key to the email service type.
p=... — the base64 public key itself, placed last by convention.

The builder strips any PEM -----BEGIN/END----- header lines from your pasted key, validates that the remainder is clean base64, and warns when an RSA-2048 record crosses the 255-byte single-string TXT limit.

Worked example

For selector s1, domain example.com, an RSA key, and SHA-256, the hostname is:

s1._domainkey.example.com

and the record value looks like:

v=DKIM1; k=rsa; h=sha256; s=email; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB...

Publish that as a TXT record, send a test message, and check the receiving server’s Authentication-Results header for dkim=pass.

Tips

Keep the private key secret and on the signing server only — only the public half ever goes in DNS.
Use a fresh selector when rotating keys so the old key can stay published until in-flight mail is delivered.
Remove t=y once verification passes; leaving test mode on undermines DMARC.
DKIM is one leg of email authentication. Pair it with SPF and a DMARC policy so receivers can act on alignment.