Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using WinServer to generate and send emails via my Goggle Apps-hosted domain (my SMTP server is . My registrar (Network Solutions) supports Text records - so I should be able to sign outgoing mail. Where do I go to generate those keys? Do I need anything running on my server - is there some other entity involved beyond inserting a text record in my registrar's DNS?


share|improve this question
openssl genrsa -out dk.key 768
openssl rsa -in dk.key -out dk.pem -pubout -outform PEM

Will generate the private key (dk.key) and public key (dk.pem).

Take the public key and c&p to a txt record:

k=rsa; t=y; p=[data from dk.key file, strip BEGIN/END blocks]

The key should be named similar to [selector] Note the selector as you'll have to configure your SMTP server with the same name so the receiving server knows where to look for the key (it can be anything you want, like "key1" or "asdf").

You should also configure a policy record for your domain. The record should be named and contain "o=-" (for all e-mail from domain must be signed) or "o=~" (for signature optional). You may also add "t=y" and some servers will be more forgiving, as it indicates you're testing.

share|improve this answer
Appreciate the details re: selector. Your reference to 'policy record' - you'd be talking about SPF entry? – justSteve Jun 25 '11 at 17:05
Nope, DKIM has a policy record too. Some mail servers accepting mail will check for your policy and if they find it will generally follow it. It's somewhat similar to SPF, but definitely not the same. You should also have a SPF record, it's more widely used too. – Chris S Jun 26 '11 at 4:00
up vote 1 down vote accepted

This page details the steps specific to generating the keys via the Google Apps control panel. Surprising that the handful of pages and posts within google's support didn't detail it this well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.