How to Find Your DKIM Selector

Your DKIM selector is the label your mail provider puts in front of ._domainkey.yourdomain where it publishes the DKIM public key. The reliable way to find it is to open a message you sent and read the s= tag in its DKIM-Signature header. If you can’t do that, you can use your provider’s known default or probe the common selectors.

Why you have to “find” it at all

DKIM (defined in RFC 6376) publishes keys at selector._domainkey.yourdomain, and the selector name is arbitrary — chosen by whoever set up signing. There’s no way to list selectors from DNS; you can only look one up if you know its name. That’s why a generic “DKIM checker” has to either be told the selector or guess it.

Method 1: read it from an email header (most reliable)

1. Send yourself an email from the domain (or open one you already sent).
2. View the raw source / original message (in Gmail: Show original).
3. Find the DKIM-Signature header and read the s= and d= tags:

   DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=selector1; ...

   Here the selector is selector1 and the signing domain is yourdomain.com. Look it up at selector1._domainkey.yourdomain.com.

Method 2: use your provider’s default selector

Most providers use predictable selectors:

• Google Workspace — google
• Microsoft 365 — selector1 and selector2
• Mailchimp / Mandrill — k1, k2
• SendGrid — s1, s2
• Amazon SES — a long token selector (read it from the header)
• Zoho — zmail / custom

Method 3: probe the common selectors

Our free DKIM checker auto-probes the common selectors (google, selector1/2, k1/k2, s1/s2, default, mail, dkim, smtp) and reports which are live. If your provider uses a custom selector, type it into the selector box and we’ll look it up directly.

A “not found” result from probing is inconclusive, not proof DKIM is broken — it just means your selector isn’t one of the common ones. Method 1 is definitive.

After you find it

Confirm the key is valid and, ideally, that you publish two selectors so you can rotate keys without downtime. Then check it alongside SPF and DMARC, since DKIM only stops spoofing when DMARC ties it to your From address.

Sources

• RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures (selectors, s= tag): https://datatracker.ietf.org/doc/html/rfc6376