How to find a domain's DKIM selector, and check its key

To check a domain's DKIM key, you need two things: the domain and the selector. The domain is easy. The selector is not, because it can be any name the sender chose, and DNS won't tell you. This guide shows how to find it in seconds from a real message, which selectors the big providers use, and how to check the key once you have it.

What is a DKIM selector?

DKIM (RFC 6376) signs each message with a private key. The matching public key sits in DNS at a name built from the selector and the signing domain:

<selector>._domainkey.<domain>

RFC 6376 section 3.6.2.1 gives the example: a signature with d=example.com and s=foo.bar means a DNS query for foo.bar._domainkey.example.com.

Selectors exist "to support multiple concurrent public keys per signing domain" (section 3.1). That lets one domain use several services, each with its own key, and lets you rotate keys by moving to a new selector.

How do I find the DKIM selector in an email header?

This is the most reliable method, because it shows the selector actually in use.

1. Get a message the domain sent. Send one from the account you're checking to a mailbox you control. Note: Microsoft says Microsoft 365 omits the DKIM signature when sender and recipient are in the same domain, or in domains controlled by the same organization, so send to an outside mailbox.

2. Open the full headers. In Gmail, use Show original. In Outlook, open the message properties or View message details. Our guide on how to read email headers covers other clients.

3. Find the DKIM-Signature header. It looks like this example from Microsoft Learn:

   DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=contoso.com;
    s=selector1;
    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
    bh=UErATeHehIIPIXPeUAfZWiKo0w2cSsOhb9XM9ulqTX0=;
   

4. Read s= and d=. Here the selector is selector1 and the signing domain is contoso.com, so the key is at selector1._domainkey.contoso.com.

5. Check every signature. A message can carry several DKIM-Signature headers, for example one from your domain and one from the sending platform. Only one whose d= aligns with your From domain helps DMARC.

The receiver's Authentication-Results header repeats the selector as header.s=, next to the dkim= result. Paste the headers into our Email Header Analyzer to pull both out without reading raw text. It runs in your browser, and nothing is uploaded.

No message to hand? Send one to our Email Deliverability Test, which shows the signatures and results for a message you send.

Which DKIM selectors do common providers use?

Use this table as a starting point, not as proof. Selectors can be changed, and the header is always the final word. Each row is from the provider's own documentation.

Microsoft 365

Microsoft says the hostnames "are the same for all Microsoft 365 organizations: selector1._domainkey and selector2._domainkey." Only one selector is active. The other "is activated and used only after any future DKIM key rotation." Each CNAME points to a Microsoft-hosted key, for example selector1-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft (domains set up before Microsoft's May 2025 format change point to onmicrosoft.com targets instead).

In some of its examples Microsoft shows the signature selector in the longer form s=selector1-contoso-com, so don't be surprised by either format. To see which selector is active, run Get-DkimSigningConfig in Exchange Online PowerShell; SelectorAfterRotateOnDate shows the selector that signs after the RotateOnDate date. Full steps are in our DKIM setup guide for Microsoft 365 and Google Workspace.

Google Workspace

Google says: "The default prefix selector is google. If you are using Google Workspace, this is the recommended option." If the domain already has a google key from another setup, Google asks you to enter a different prefix. So the key is usually at google._domainkey.yourdomain, but the Admin console (Apps > Google Workspace > Gmail > Authenticate email) shows the real one.

Sending platforms

SendGrid says you might set a custom selector if "another service uses the Twilio SendGrid DKIM selector." Mailchimp's domain authentication uses two CNAME records, so copy them from its manual setup screen rather than guessing. Amazon SES Easy DKIM asks you to publish "the three CNAME records" shown in the console, each named after a token. Our per-provider pages for SendGrid, Mailchimp, Fastmail and Amazon SES cover the DNS side.

Why can't a tool find my DKIM selector?

Because DKIM tools can only guess. Our DKIM Checker tries a list of common selector names when you don't enter one. If none match, it reports the selector as unknown, not failed. That's deliberate. A domain with a selector named s202610 or mktg2 has perfectly good DKIM that no guess will find.

Other reasons a lookup comes back empty:

• The selector is on a different domain. If d= is a subdomain such as mail.example.com, look up selector._domainkey.mail.example.com.
• The CNAME target is broken. The name exists but points nowhere. Microsoft lists a hostname with the domain added twice, such as selector1._domainkey.contoso.com.contoso.com, as a common mistake.
• The key was revoked. An empty p= means the key has been retired on purpose (RFC 6376 section 6.1.2).
• DNS hasn't updated yet. Microsoft says propagation can take "a few minutes to 48 hours."

How do I check the DKIM key once I have the selector?

1. Look it up. Enter the domain and selector in the DKIM Checker. It follows CNAMEs, reads the TXT record and reports the key type and length. From a terminal:

   dig TXT selector1._domainkey.example.com +short
   

2. Confirm the record is a DKIM key. It should contain p= with a long base64 value, and usually v=DKIM1 and k=rsa.

3. Check the key length. RFC 8301 says signers "MUST use RSA keys of at least 1024 bits" and "SHOULD use RSA keys of at least 2048 bits." Google requires at least 1024 bits for personal Gmail accounts and recommends 2048.

4. Check there's only one record at that name. RFC 6376 says that if there are several TXT records for a selector, "the results are undefined."

5. Confirm it verifies. Send a test message and look for dkim=pass with the same header.s= in Authentication-Results. If you see a failure, read DKIM body hash did not verify.

What do the tags in a DKIM key record mean?

Once the lookup returns a record, you can read it yourself. RFC 6376 section 3.6.1 defines the tags:

Two of these catch people out. A record left at t=y asks receivers not to treat your signed mail differently from unsigned mail: RFC 6376 says verifiers "MUST NOT treat messages from Signers in testing mode differently from unsigned email, even should the signature fail to verify." Remove t=y once signing works. And a record that starts with a v= value other than DKIM1 "MUST be discarded."

How do I find the selector without a sent message?

If you can't send a test message, look in the place the key was created:

• Microsoft 365: the Defender portal's Email authentication settings page, DKIM tab, or Get-DkimSigningConfig -Identity yourdomain | Format-List Selector1CNAME,Selector2CNAME in Exchange Online PowerShell.
• Google Workspace: the Admin console under Apps > Google Workspace > Gmail > Authenticate email, which shows the DNS host name, such as google._domainkey.
• Sending platforms: the domain authentication or sender settings page, which lists the exact records to publish.
• Your DNS zone: any record with _domainkey in its name is a selector. This only works if you can see the whole zone, for example in your DNS host's control panel.

The zone view is handy for audits. Every _domainkey record you find should map to a service you still use; retire the rest with an empty p=.

Keep a selector inventory

Once you've found them, write them down: domain, service, selector, key length and the date it went live. It makes DKIM key rotation routine and shows you which keys to retire when you drop a service. If you run your own mail server, the DKIM Key Generator creates a new key pair and the TXT record for a selector name you choose.

Next steps

1. Send yourself a message from each service that sends as your domain, and note every s= and d= pair.
2. Check each one in the DKIM Checker for a valid key of at least 2048 bits where the provider supports it.
3. Make sure at least one signature per service uses your domain, so DMARC can align. Why DMARC fails explains what happens when it doesn't.
4. New to DMARC? What is DMARC explains how DKIM fits in.

If you also want inbound mail screened for spoofing and phishing before it reaches your users, iBlockSpam filters at the MX level; see how it works.

Browse our other SPF, DKIM and DMARC guides.