What this analysis does
The RSA key pair is created with Web Crypto inside the page — the private key never leaves the browser. Mailybox then formats the public key with the right tags, splits values longer than 255 bytes into quoted strings, flags weak or oversized keys, and can compare the record with what the selector currently publishes so signing and DNS agree before mail is sent.
A DKIM deployment has two halves that must agree: a private key that signs outgoing mail and a public key published in DNS under a selector. This tool generates the key pair in your browser, formats the DNS record correctly, and verifies that what DNS publishes matches the key you intend to sign with.
The private key never leaves your browser
Key generation uses the browser’s Web Crypto API. The private key is produced locally, shown once so you can install it on your mail server or sending platform, and discarded when the page is closed. Nothing about the private key is transmitted; only the public key is sent for formatting.
This matters because a DKIM private key is the credential that lets a sender sign as your domain. A key generated by a remote service would have existed on that service, which is a trust relationship most organizations should not accept. If your platform generates keys itself, paste the public key it gives you instead.
- RSA-2048 is generated in-browser with Web Crypto.
- Private keys pasted into the public-key field are rejected.
- Platforms that supply their own public key can be used directly.
Record length and string splitting
A 2048-bit RSA public key produces a TXT value longer than 255 bytes, which is the maximum length of a single character-string in DNS. The value must be published as several quoted strings inside one TXT record; resolvers concatenate them. Most DNS panels split automatically, but some truncate silently and the selector then publishes a corrupted key.
The tool shows both the joined value and the split form. If your panel rejects the long value, paste the split form. After publishing, use the verify option to confirm the key that resolves is byte-for-byte the key you supplied.
Inspect any published selector in detailRead the selector rotation guide
Use selectors to rotate without downtime
A selector is a free-form label that lets several keys coexist under one domain. Publish the new selector, switch signing to it, and only then remove the old one — mail already in transit keeps verifying against the old selector while it remains published.
Date-based selector names make rotation history readable and make it obvious when a key has been in service too long. Keys should be rotated periodically and immediately if the signing system may have been compromised.
Example: verifying a freshly published selector
Evidence supplied
Selector mail2026 for example.com, public key generated in-browser, verify option enabled.
How to read the result
The tool formats the record, splits it into two strings, and queries mail2026._domainkey.example.com. If the published p= value matches the supplied key, signing with the generated private key will verify; if it differs, the DNS value was altered or truncated and must be republished.
Known limits
- Ed25519 keys are accepted for formatting but not generated here, because browser support for that algorithm is uneven.
- A correct DNS record does not confirm that the mail server is actually signing with the matching private key; send a test message and inspect the header.
- Some receivers still do not verify Ed25519 signatures; publish an RSA selector alongside.
Common questions
Is it safe to generate the key here?
The key pair is generated by your browser and the private half is never sent anywhere. If you prefer, generate with openssl on your own system and paste only the public key.
Why does my DNS panel reject the value?
It is longer than 255 bytes. Publish it as multiple quoted strings using the split form shown, or choose a panel that splits automatically.
How do I know signing works end to end?
Send a real message to a mailbox you control and inspect the Authentication-Results header for dkim=pass with your selector and domain.