I found this site. But if I use it, doesn't it mean that port25.com would know and be able to use my private key?

3 Answers 3


You can use that to generate a sample configuration, but should use openssl to generate your real keys.

\\ Generate a private key
openssl genrsa -out domainname.com.key 1024

\\ Generate a public key
openssl rsa -in domainname.com.key -out rsa.public -pubout -outform PEM

After running those you'll have two files:

# lc
total 3
-rw-r--r--  1 chris  chris   887B Jun  5 15:51 domainname.com.key
-rw-r--r--  1 chris  chris   272B Jun  5 15:51 rsa.public

With contents like:

# cat *
-----END PUBLIC KEY-----

Yes, if you use their wizard and add the DKIM record it provides they will have all they need to send validly signed mail from your domain.

In general, something strange is going on if someone else is providing you with what is supposedly your private key.

From my point of view, port25.com having that wizard makes them look unprofessional, possibly even suspicious. Even if you trust them (maybe you have a business relationship with them?), they deliver the keys to you in the plain over the Internet.


port25.com is asking you to provide a DomainKey Selector (e.g., key1) - which is NOT the same as private key that you generated using openssl or some other tools.

To make it easier, try use more native tools instead: DKIM Core Tools

  • Generate a DKIM Core Key
  • Check a published DKIM Core Key
  • Check a DKIM Core Key Record

DKIM Core Technical Specification covers following:

1.  Create the selector and associated key pair
2.  Publish the public key
3.  Attach the token to the email
3.1 Find the body hash
3.2 Find the header hash
3.2 Generate the DKIM-Signature header
3.3 Multiple Tokens
  • After I enter domain and selector, it gives me private/public pair. Is it safe to use them on my actual site?
    – ironic
    Jun 5, 2014 at 16:12
  • Yes it is, if you so concert about that you can always go route that @chris-s described (assuming you're technical enough) or you can use tools that provided by DKIM team for everyone to use in order to simplify process.
    – alexus
    Jun 5, 2014 at 16:18
  • But if I use the keys which they give me, what would stop them(except reputation concerns, and the fact that this is a useless thing to do) if they want use the private key to sign a message on my behalf?
    – ironic
    Jun 5, 2014 at 16:24
  • @ironic if it'll help you sleep better and the fact that you think so highly about people who invented DKIM and created tools to make YOUR life easier, go ahead and generate it locally; Technology wise it'll work exactly the same, no difference, also keep in mind DKIM folks can't just use that certificate on it's own, you also need to make some DNS changes and they have no control over it, only domain owners have that kind of access.
    – alexus
    Jun 5, 2014 at 16:33
  • 1
    -1 No, if you use that Port25's website they will have your private key. Did you even look at the site he linked to? There's a big difference between "I don't think they keep the keys" and "I can guarantee nobody else has your keys".
    – Chris S
    Jun 5, 2014 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.