To get a DKIM public key in your DNS, you need to generate the DKIM key pair (public and private keys) and then publish the public key as a DNS TXT record. Here's how you can do it:
Step 1: Generate a DKIM Key Pair
Using Your Email Service Provider:
Email Service Provider: If you're using an email service provider (e.g., G Suite, Microsoft 365, cPanel), they typically offer a tool to generate DKIM keys. Follow their instructions to generate the keys.
cPanel Example:
Log in to cPanel.
Navigate to Email > Email Deliverability.
Locate your domain and click "Manage."
Enable DKIM and cPanel will generate the key pair for you.
Manually Generating DKIM Keys:
Linux Command Line: If you're managing your own server, you can generate the key pair using openssl:
Run the following command to generate a 2048-bit private key:
openssl genrsa -out private.key 2048
Extract the public key from the private key:
openssl rsa -in private.key -pubout -out public.key
Step 2: Prepare the DKIM Public Key for DNS
Format the Public Key: The public key needs to be in the correct format for DNS:
Open the public.key file and copy the key content.
Remove the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines, leaving just the base64-encoded key.
Remove any line breaks, so the key is a single continuous string.
Step 3: Add the DKIM Public Key to Your DNS
Access Your DNS Management Interface:
Log in to your DNS hosting provider’s control panel (e.g., GoDaddy, Cloudflare, Namecheap, etc.).
Create a New TXT Record:
Type: Select TXT as the record type.
Name/Host: Enter the selector name, followed by .domainkey.yourdomain.com.
Example: If your selector is default, the host name would be default.domainkey.yourdomain.com.
Value/Content: Enter the DKIM public key in the following format:
v=DKIM1; k=rsa; p=your_public_key_here
v=DKIM1: Indicates the DKIM version.
k=rsa: Specifies the key type (RSA).
p=your_public_key_here: Replace this with the actual public key from the previous step.
Save the DNS Record:
Save the TXT record in your DNS management interface.
Step 4: Verify the DKIM Record
Use Online Tools: After DNS propagation (which can take up to 48 hours), verify the DKIM record using tools like:
MXToolbox DKIM Lookup
DKIMCore
Check via Command Line: You can also use command-line tools like dig to check the DKIM record:
dig TXT default._domainkey.yourdomain.com
Example of a DNS TXT Record
If your selector is default and your domain is example.com, the DNS record would look like this:
Type: TXT
Name/Host: default._domainkey.example.com
Value/Content:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7gW9Jt...
Step 5: Configure Your Mail Server
Match the Selector: Ensure that the selector used in your mail server matches the one used in your DNS record.
Enable DKIM Signing: Configure your mail server to sign outgoing emails with the DKIM private key.
Conclusion
By following these steps, you can successfully publish your DKIM public key in DNS. This will allow receiving mail servers to verify the DKIM signature on your outgoing emails, helping to ensure that they are properly authenticated and less likely to be marked as spam.
