DKIM (DomainKeys Identified Mail) is an email authentication method that allows the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain. It uses a public key published in a DNS TXT record.

The selector is a unique name that helps locate the correct DKIM public key for a domain. Multiple selectors can exist for different services (e.g., "google", "default", "mail"). The DNS record is placed at selector._domainkey.yourdomain.com.

Copy the "Name" and "Value" shown above. Go to your DNS provider's management console, create a new TXT record with that exact name and paste the value. Allow up to 48 hours for propagation, though changes often take effect in minutes.

Absolutely. Key generation happens entirely on your device using the Web Crypto API. The private key is never transmitted to any server. You are responsible for saving the private key securely.

2048 bits is the current recommended minimum. 1024 bits is considered weak and may not be accepted by strict email receivers. Always prefer 2048 or higher for production use.

Yes, switch to "I Have Public Key" mode and paste your base64 encoded public key. This is useful if you already generated a key pair elsewhere (e.g., using OpenSSL) and only need the DNS record syntax.