Which key to choose
RSA 2048 is what every receiver verifies. Ed25519 keys are short and fast but not yet verified everywhere, so publish one next to an RSA key and sign with both (RFC 8463). Use RSA 1024 only if your DNS host cannot store a record over 255 characters.
Rotating keys
Publish the new key under a new selector, switch your mail system to sign with it, wait a few days for messages in flight, then revoke the old selector by publishing v=DKIM1; p=. EmailSecOps tracks each selector's key and reminds you once it has seen the same key for six months (keys your provider hosts behind a CNAME are rotated by the provider and left out).
DKIM key generator: questions
Should I use RSA or Ed25519 for DKIM?+
Use RSA 2048, and add Ed25519 only as a second key. Every receiver verifies RSA, while Ed25519 (RFC 8463) gives shorter keys and signatures but is not yet verified everywhere. If you want it, publish the Ed25519 key under its own selector next to the RSA key and sign each message with both, so receivers that skip Ed25519 still find a valid RSA signature.
Should a DKIM key be 2048 or 4096 bits?+
2048 bits suits almost every domain. RFC 8301 requires verifiers to handle RSA keys from 1024 to 4096 bits, so a 4096-bit key works, but its TXT value is over 700 characters long, which some DNS panels and providers handle badly. Choose 4096 only if your security policy requires it and your DNS host stores long records intact.
How do I publish a DKIM key longer than 255 characters?+
Split the value into several quoted strings inside one TXT record; receivers join them without spaces (RFC 6376 §3.6.2.2). Most DNS panels do this automatically when you paste the full value, and in a zone file you write the strings one after another in parentheses: ( "first 255 characters" "the rest" ). The DKIM checker detects keys cut off at a string boundary.
How do I rotate a DKIM key?+
Publish the new key under a new selector, switch your mail system to sign with it, and wait a few days for mail signed with the old key to be delivered. Then revoke the old selector by publishing v=DKIM1; p= with no key. Dated selectors such as s202610 keep rotations easy to follow. For monitored domains, EmailSecOps reminds you once it has seen the same key for six months.
Is it safe to generate a DKIM key online?+
With this generator, yes: the key pair is created in your browser with the Web Crypto API and the private key is never sent to EmailSecOps. Wherever a key comes from, treat the private key like a password: install it only on the system that signs your mail, never send it by email or chat, and replace the key pair if it may have leaked.
Do I need to generate a DKIM key for Google Workspace or Microsoft 365?+
No. Google Workspace generates the key in its Admin console and gives you the TXT record to publish, and Microsoft 365 hosts its keys behind two CNAME records, selector1 and selector2. Generate your own key only for a mail server you run, or for a service that asks you to supply a private key.