Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I found this site. But if I use it, doesn't it mean that would know and be able to use my private key?

share|improve this question

3 Answers 3

You can use that to generate a sample configuration, but should use openssl to generate your real keys.

\\ Generate a private key
openssl genrsa -out 1024

\\ Generate a public key
openssl rsa -in -out rsa.public -pubout -outform PEM

After running those you'll have two files:

# lc
total 3
-rw-r--r--  1 chris  chris   887B Jun  5 15:51
-rw-r--r--  1 chris  chris   272B Jun  5 15:51 rsa.public

With contents like:

# cat *
-----END PUBLIC KEY-----
share|improve this answer

Yes, if you use their wizard and add the DKIM record it provides they will have all they need to send validly signed mail from your domain.

In general, something strange is going on if someone else is providing you with what is supposedly your private key.

From my point of view, having that wizard makes them look unprofessional, possibly even suspicious. Even if you trust them (maybe you have a business relationship with them?), they deliver the keys to you in the plain over the Internet.

share|improve this answer is asking you to provide a DomainKey Selector (e.g., key1) - which is NOT the same as private key that you generated using openssl or some other tools.

To make it easier, try use more native tools instead: DKIM Core Tools

  • Generate a DKIM Core Key
  • Check a published DKIM Core Key
  • Check a DKIM Core Key Record

DKIM Core Technical Specification covers following:

1.  Create the selector and associated key pair
2.  Publish the public key
3.  Attach the token to the email
3.1 Find the body hash
3.2 Find the header hash
3.2 Generate the DKIM-Signature header
3.3 Multiple Tokens
share|improve this answer
After I enter domain and selector, it gives me private/public pair. Is it safe to use them on my actual site? –  ironic Jun 5 '14 at 16:12
Yes it is, if you so concert about that you can always go route that @chris-s described (assuming you're technical enough) or you can use tools that provided by DKIM team for everyone to use in order to simplify process. –  alexus Jun 5 '14 at 16:18
But if I use the keys which they give me, what would stop them(except reputation concerns, and the fact that this is a useless thing to do) if they want use the private key to sign a message on my behalf? –  ironic Jun 5 '14 at 16:24
@ironic if it'll help you sleep better and the fact that you think so highly about people who invented DKIM and created tools to make YOUR life easier, go ahead and generate it locally; Technology wise it'll work exactly the same, no difference, also keep in mind DKIM folks can't just use that certificate on it's own, you also need to make some DNS changes and they have no control over it, only domain owners have that kind of access. –  alexus Jun 5 '14 at 16:33
-1 No, if you use that Port25's website they will have your private key. Did you even look at the site he linked to? There's a big difference between "I don't think they keep the keys" and "I can guarantee nobody else has your keys". –  Chris S Jun 5 '14 at 18:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.