Guides · Email · Updated

What is a DKIM selector, and how do you find yours?

A DKIM selector is a label that tells a receiving server which DNS record holds the public key for a signature. The record sits at selector._domainkey.yourdomain. You can read your selector from the s= value in the DKIM-Signature header of any message you have sent.

Check a selector

Enter a domain and a selector to read and validate the key. Leave the selector empty to try common ones:

How it fits together

When a mail server signs a message, it adds a header like this:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; h=from:to:subject; bh=...; b=...
  • d= is the signing domain.
  • s= is the selector.

The receiver builds the DNS name selector1._domainkey.example.com, fetches the public key published there and uses it to check the signature. The selector exists so one domain can have several keys at once, for example one per sending service.

Find your selector

  1. Send yourself a message from the account you want to check, to an address you can read.
  2. Open its full headers. In Gmail, open the message, choose the three dots, then Show original. In Outlook, open the message, then File, Properties, and read Internet headers. Other clients have a similar "view source" or "show headers" option.
  3. Find DKIM-Signature and read s=. That value is the selector. d= next to it is the domain to query.
  4. Enter both in the checker above.

Your email provider's own setup page also names it. See the provider pages for Google Workspace, Microsoft 365, GoDaddy and Salesforce.

What the record looks like

selector1._domainkey.example.com.  3600  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."
  • v=DKIM1: the version.
  • k=rsa: the key type.
  • p=: the public key in base64. An empty p= means the key was revoked.

Some providers publish a CNAME at that name that points to a record they host, so they can rotate the key without you touching DNS. Check it from a terminal with dig TXT selector1._domainkey.example.com +short. See DNS lookup commands.

Common selector names

The provider decides the name, so read it from the header rather than guessing. Commonly seen ones are google (Google Workspace), selector1 and selector2 (Microsoft 365), and generic names such as default, s1, s2 and mail.

Good practice

  • Use 2048-bit keys where your DNS host and provider allow it.
  • Rotate keys now and then. Publish the new selector, switch signing to it, and remove the old one later.
  • Remove selectors for services you no longer use.

DKIM is one of three checks; see SPF, DKIM and DMARC explained. If it fails, why DKIM or DMARC fails lists the causes.

Frequently asked questions

What is a DKIM selector?

A short label that tells a receiving server which DNS record holds the public key for a signature. The record lives at selector._domainkey.yourdomain.

How do I find my DKIM selector?

Open a message you sent in your own mailbox, view its full headers, and read the s= value in the DKIM-Signature header. Your email provider's DKIM setup page also names it.

What are common DKIM selectors?

google for Google Workspace, selector1 and selector2 for Microsoft 365, and names such as default, s1, s2 or mail for others. The provider decides, so use the s= value, not a guess.

Can a domain have more than one selector?

Yes. Each sending service usually has its own, and one service can have two so it can rotate keys without a gap.

What does a DKIM record look like?

A TXT record such as v=DKIM1; k=rsa; p= followed by a long base64 public key. Some providers publish a CNAME that points to a record they host.