How to set up DKIM
Your provider generates the key, not you. This page says where each provider hands it to you, and what to check once it is published.
Why there is no key generator here
A browser can generate an RSA key pair — that part is easy. The problem is that the key would be unusable. Google Workspace, Microsoft 365, SendGrid, Mailgun, Postmark and Mailchimp all generate their own key and hand you the record to publish; none of them accept a key you bring. A generator here would give you something you cannot paste anywhere, so we did not build one.
What happens, in order
- 1Your provider generates a key pair and keeps the private half. It never leaves them, and you should never be asked to paste a private key anywhere.
- 2They give you a record to publish — a TXT record with the public key, or a CNAME pointing at a record they host. Which one depends on the provider.
- 3You publish it in your DNS, under a selector name they choose.
- 4They turn on signing. Until you do this last step, the record exists but nothing is signed.
Selectors we recognise
Selector names cannot be discovered from DNS — there is no way to list what exists under _domainkey. These are the names we probe when you do not supply one, and the provider each belongs to. Not finding a selector proves nothing.
| D-engage | dengage |
| Emarsys | key2emarsys-2048b |
| Fastmail | fm1 |
| Google Workspace | google |
| HubSpot | hs1 |
| Mailchimp | k1 |
| Mailgun | mgsmtp |
| Mailjet | mailjet |
| Mandrill | mandrill |
| Microsoft 365 | selector1selector2 |
| Postmark | pm |
| Proton | protonmail |
| SendGrid | s1s2smtpapi |
| SmartMessage | dkim |
| Zendesk | zendesk1 |
| Zoho | zoho |
Plus 7 generic names that belong to no particular provider — default, mail, s1 and the like.
Once it is published
Give DNS time, then read the key back. Two things are worth confirming: that the key is actually there, and that it is 2048-bit rather than 1024. An empty p= means the key is revoked, which is a deliberate signal and not a typo.
Check a DKIM key