How to find your DKIM selector
To find your DKIM selector, open a message your domain sent, view its full headers, and read the s= value in the DKIM-Signature line. The selector tells you where the public key lives in DNS: selector._domainkey.yourdomain. This guide shows where to look in Gmail and Outlook and how to confirm the key.
What is a DKIM selector?
A selector is a name the sending service picks so one domain can publish several DKIM keys at once, for example one per service or one per key rotation. Receivers combine it with your domain to find the public key at selector._domainkey.yourdomain. The selector travels with every signed message in the s= tag. (RFC 6376, section 3.1)
How do I find the selector in an email header?
Find the line that starts with DKIM-Signature and read two tags: d= is the signing domain and s= is the selector. A message can carry more than one signature, so check that d= is your domain. A signature with your sending tool's domain does not help your DMARC alignment. (dmarcian)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=google; h=from:to:subject:date; ...
In this example the selector is google and the key is at google._domainkey.example.com.
How do I see full headers in Gmail?
Open the message, click the three-dot menu at the top right of the message, and choose Show original. Gmail opens a page with the full headers and a short summary showing whether SPF, DKIM and DMARC passed. Search the page for DKIM-Signature to find the s= tag. Send a test from your domain to a Gmail address if needed. (Google, dmarcian)
How do I see full headers in Outlook?
In classic Outlook for Windows, open the message in its own window, choose File, then Properties, and look in the Internet headers box. Search the text for DKIM-Signature and read the s= tag. The exact menu differs between Outlook versions, so if you cannot find it, send the message to a Gmail address and use Show original. (dmarcian)
Why can't I look up every selector in DNS?
DNS answers questions about a name you already know; it has no standard way to list every name under _domainkey. A checker can only try selectors it is told about or common guesses. That is why the checker tries a list of common selectors and lets you enter your own. If none match, take the selector from a real message header.
What selectors do Google and Microsoft use?
Google Workspace's default selector is google, unless an admin chose a different prefix when generating the key. Microsoft 365 uses two selectors, selector1 and selector2, published as CNAME records that point to keys Microsoft hosts and rotates. Other sending tools set their own selectors, which appear in their DNS setup instructions. See the setup guide for both.
How do I check the DKIM key once I have the selector?
Enter your domain and the selector in the SPF, DKIM and DMARC checker. It looks up selector._domainkey.yourdomain, confirms a public key is published, and reports the RSA key size. Google requires at least a 1024-bit key to send to personal Gmail accounts and recommends 2048 bits. (Google)
Already have the selector? Check your DKIM key now.
Frequently asked questions
Can a domain have more than one DKIM selector?
Yes. Each service that signs mail for you usually has its own selector, and providers that rotate keys use two. Every one of them can be valid at the same time.
What if the message has no DKIM-Signature line?
The service sent it without DKIM. Turn on DKIM signing in that service's settings and publish the key it gives you, then send a new test message.
Is the selector secret?
No. It appears in every message you send and only points to a public key. The private key stays with the sending service.
Why does the checker say no DKIM key was found?
Either the selector is not one of the common ones it tries, or the record is not published yet. Enter the exact selector from your message header and check again.