# How to find a domain's DKIM selector, and check its key URL: https://iblockspam.com/blog/find-dkim-selector Last updated: 2026-10-09 Published: 2026-10-09 Topic: SPF, DKIM & DMARC Author: iBlockSpam Team > Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key. ## Short answer The reliable way to find a DKIM selector is to open a message the domain sent, view the headers and read the s= value in the DKIM-Signature header; d= is the signing domain. The public key is at s._domainkey.d. Microsoft 365 uses selector1 and selector2, Google Workspace uses google by default. DNS can't list selectors. To check a domain's DKIM key, you need two things: the domain and the **selector**. The domain is easy. The selector is not, because it can be any name the sender chose, and DNS won't tell you. This guide shows how to find it in seconds from a real message, which selectors the big providers use, and how to check the key once you have it. ## What is a DKIM selector? DKIM ([RFC 6376](https://www.rfc-editor.org/rfc/rfc6376.html)) signs each message with a private key. The matching public key sits in DNS at a name built from the selector and the signing domain: ``` ._domainkey. ``` RFC 6376 section 3.6.2.1 gives the example: a signature with `d=example.com` and `s=foo.bar` means a DNS query for `foo.bar._domainkey.example.com`. Selectors exist "to support multiple concurrent public keys per signing domain" (section 3.1). That lets one domain use several services, each with its own key, and lets you rotate keys by moving to a new selector. ## How do I find the DKIM selector in an email header? This is the most reliable method, because it shows the selector actually in use. 1. **Get a message the domain sent.** Send one from the account you're checking to a mailbox you control. Note: Microsoft says Microsoft 365 omits the DKIM signature when sender and recipient are in the same domain, or in domains controlled by the same organization, so send to an outside mailbox. 2. **Open the full headers.** In Gmail, use **Show original**. In Outlook, open the message properties or **View message details**. Our guide on [how to read email headers](https://iblockspam.com/blog/how-to-read-email-headers) covers other clients. 3. **Find the `DKIM-Signature` header.** It looks like this example from [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure): ``` DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=contoso.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UErATeHehIIPIXPeUAfZWiKo0w2cSsOhb9XM9ulqTX0=; ``` 4. **Read `s=` and `d=`.** Here the selector is `selector1` and the signing domain is `contoso.com`, so the key is at `selector1._domainkey.contoso.com`. 5. **Check every signature.** A message can carry several `DKIM-Signature` headers, for example one from your domain and one from the sending platform. Only one whose `d=` aligns with your From domain helps DMARC. The receiver's `Authentication-Results` header repeats the selector as `header.s=`, next to the `dkim=` result. Paste the headers into our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to pull both out without reading raw text. It runs in your browser, and nothing is uploaded. No message to hand? Send one to our [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test), which shows the signatures and results for a message you send. ## Which DKIM selectors do common providers use? Use this table as a starting point, not as proof. Selectors can be changed, and the header is always the final word. Each row is from the provider's own documentation. | Provider | Selector(s) | Record type in your DNS | Source | |---|---|---|---| | Microsoft 365 (custom domain) | `selector1`, `selector2` | Two CNAMEs to keys Microsoft hosts | [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure) | | Google Workspace | `google` (default prefix) | One TXT record | [Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/set-up-dkim) | | SendGrid, automated security on | `s1`, `s2` | Two CNAMEs | [Twilio SendGrid Docs](https://www.twilio.com/docs/sendgrid/ui/account-and-settings/how-to-set-up-domain-authentication) | | SendGrid, automated security off | `m1` | One TXT record | Same | | Fastmail | `fm1`, `fm2`, `fm3` | Three CNAMEs | [Fastmail Help](https://www.fastmail.help/hc/en-us/articles/360060591153-Manual-DNS-configuration) | | Amazon SES (Easy DKIM) | Random tokens, e.g. `abc123` | Three CNAMEs | [Amazon SES Developer Guide](https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html) | ### Microsoft 365 Microsoft says the hostnames "are the same for all Microsoft 365 organizations: `selector1._domainkey` and `selector2._domainkey`." Only one selector is active. The other "is activated and used only after any future DKIM key rotation." Each CNAME points to a Microsoft-hosted key, for example `selector1-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft` (domains set up before Microsoft's May 2025 format change point to `onmicrosoft.com` targets instead). In some of its examples Microsoft shows the signature selector in the longer form `s=selector1-contoso-com`, so don't be surprised by either format. To see which selector is active, run `Get-DkimSigningConfig` in Exchange Online PowerShell; `SelectorAfterRotateOnDate` shows the selector that signs after the `RotateOnDate` date. Full steps are in our [DKIM setup guide for Microsoft 365 and Google Workspace](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace). ### Google Workspace Google says: "The default prefix selector is google. If you are using Google Workspace, this is the recommended option." If the domain already has a `google` key from another setup, Google asks you to enter a different prefix. So the key is usually at `google._domainkey.yourdomain`, but the Admin console (**Apps > Google Workspace > Gmail > Authenticate email**) shows the real one. ### Sending platforms SendGrid says you might set a custom selector if "another service uses the Twilio SendGrid DKIM selector." Mailchimp's domain authentication uses two CNAME records, so copy them from its manual setup screen rather than guessing. Amazon SES Easy DKIM asks you to publish "the three CNAME records" shown in the console, each named after a token. Our per-provider pages for [SendGrid](https://iblockspam.com/spf/sendgrid), [Mailchimp](https://iblockspam.com/spf/mailchimp), [Fastmail](https://iblockspam.com/spf/fastmail) and [Amazon SES](https://iblockspam.com/spf/amazon-ses) cover the DNS side. ## Why can't a tool find my DKIM selector? Because DKIM tools can only guess. Our [DKIM Checker](https://iblockspam.com/tools/dkim-checker) tries a list of common selector names when you don't enter one. If none match, it reports the selector as **unknown, not failed**. That's deliberate. A domain with a selector named `s202610` or `mktg2` has perfectly good DKIM that no guess will find. Other reasons a lookup comes back empty: - **The selector is on a different domain.** If `d=` is a subdomain such as `mail.example.com`, look up `selector._domainkey.mail.example.com`. - **The CNAME target is broken.** The name exists but points nowhere. Microsoft lists a hostname with the domain added twice, such as `selector1._domainkey.contoso.com.contoso.com`, as a common mistake. - **The key was revoked.** An empty `p=` means the key has been retired on purpose (RFC 6376 section 6.1.2). - **DNS hasn't updated yet.** Microsoft says propagation can take "a few minutes to 48 hours." ## How do I check the DKIM key once I have the selector? 1. **Look it up.** Enter the domain and selector in the [DKIM Checker](https://iblockspam.com/tools/dkim-checker). It follows CNAMEs, reads the TXT record and reports the key type and length. From a terminal: ``` dig TXT selector1._domainkey.example.com +short ``` 2. **Confirm the record is a DKIM key.** It should contain `p=` with a long base64 value, and usually `v=DKIM1` and `k=rsa`. 3. **Check the key length.** [RFC 8301](https://www.rfc-editor.org/rfc/rfc8301.html) says signers "MUST use RSA keys of at least 1024 bits" and "SHOULD use RSA keys of at least 2048 bits." Google requires at least 1024 bits for personal Gmail accounts and recommends 2048. 4. **Check there's only one record at that name.** RFC 6376 says that if there are several TXT records for a selector, "the results are undefined." 5. **Confirm it verifies.** Send a test message and look for `dkim=pass` with the same `header.s=` in `Authentication-Results`. If you see a failure, read [DKIM body hash did not verify](https://iblockspam.com/blog/dkim-fail-body-hash-did-not-verify). ## What do the tags in a DKIM key record mean? Once the lookup returns a record, you can read it yourself. RFC 6376 section 3.6.1 defines the tags: | Tag | Required? | Meaning | |---|---|---| | `v=` | Recommended | Version. If present, must be `DKIM1` and must come first | | `k=` | Optional | Key type. Default `rsa`; [RFC 8463](https://www.rfc-editor.org/rfc/rfc8463.html) adds `ed25519` | | `p=` | Required | The public key in base64. Empty means revoked | | `h=` | Optional | Hash algorithms the key may be used with | | `t=` | Optional | Flags. `y` means the domain is testing DKIM | | `s=` | Optional | Service type, default `*` (all) | | `n=` | Optional | Notes for humans; ignored by software | Two of these catch people out. A record left at `t=y` asks receivers not to treat your signed mail differently from unsigned mail: RFC 6376 says verifiers "MUST NOT treat messages from Signers in testing mode differently from unsigned email, even should the signature fail to verify." Remove `t=y` once signing works. And a record that starts with a `v=` value other than `DKIM1` "MUST be discarded." ## How do I find the selector without a sent message? If you can't send a test message, look in the place the key was created: - **Microsoft 365:** the Defender portal's **Email authentication settings** page, **DKIM** tab, or `Get-DkimSigningConfig -Identity yourdomain | Format-List Selector1CNAME,Selector2CNAME` in Exchange Online PowerShell. - **Google Workspace:** the Admin console under **Apps > Google Workspace > Gmail > Authenticate email**, which shows the DNS host name, such as `google._domainkey`. - **Sending platforms:** the domain authentication or sender settings page, which lists the exact records to publish. - **Your DNS zone:** any record with `_domainkey` in its name is a selector. This only works if you can see the whole zone, for example in your DNS host's control panel. The zone view is handy for audits. Every `_domainkey` record you find should map to a service you still use; retire the rest with an empty `p=`. ## Keep a selector inventory Once you've found them, write them down: domain, service, selector, key length and the date it went live. It makes [DKIM key rotation](https://iblockspam.com/blog/dkim-key-rotation) routine and shows you which keys to retire when you drop a service. If you run your own mail server, the [DKIM Key Generator](https://iblockspam.com/tools/dkim-generator) creates a new key pair and the TXT record for a selector name you choose. ## Next steps 1. Send yourself a message from each service that sends as your domain, and note every `s=` and `d=` pair. 2. Check each one in the [DKIM Checker](https://iblockspam.com/tools/dkim-checker) for a valid key of at least 2048 bits where the provider supports it. 3. Make sure at least one signature per service uses your domain, so DMARC can align. [Why DMARC fails](https://iblockspam.com/blog/why-dmarc-fails) explains what happens when it doesn't. 4. New to DMARC? [What is DMARC](https://iblockspam.com/blog/what-is-dmarc) explains how DKIM fits in. If you also want inbound mail screened for spoofing and phishing before it reaches your users, iBlockSpam filters at the MX level; see [how it works](https://iblockspam.com/how-it-works). Browse our other [SPF, DKIM and DMARC guides](https://iblockspam.com/blog/topic/authentication). ## Frequently asked questions ### Can I list all the DKIM selectors a domain uses? No. Selectors are just DNS names under _domainkey, and DNS has no standard way to list every name in a zone. Tools can only guess common names. Read s= from a real message instead, or check your provider's admin console. A selector a tool can't find is unknown, not broken. ### What DKIM selector does Microsoft 365 use? For a custom domain, the DNS records are always selector1._domainkey and selector2._domainkey, both CNAMEs pointing to keys Microsoft hosts. Only one is active at a time; the other is used after a key rotation. Check s= in a sent message to see which one is signing. ### What DKIM selector does Google Workspace use? The default prefix is google, so the key is a TXT record at google._domainkey.yourdomain. Google lets you pick another prefix if your domain already uses google for a different key, so confirm the selector in the Admin console or in a sent message. ### Can one domain have several DKIM selectors? Yes, and most do. RFC 6376 created selectors so a domain can publish several keys at once. Each sending service, such as your mail platform, newsletter tool and helpdesk, should have its own selector and key, which also makes rotation and retirement easier. ### Why does my DKIM selector point to a CNAME? Many providers host the key themselves so they can rotate it without asking you to edit DNS. You publish a CNAME, and receivers follow it to the provider's TXT record. Microsoft 365, SendGrid with automated security, Fastmail and Amazon SES Easy DKIM all work this way. ## Sources - [RFC 6376: DKIM Signatures, sections 3.1 (Selectors) and 3.6.2 (DNS binding)](https://www.rfc-editor.org/rfc/rfc6376.html) - [Microsoft Learn: How to use DKIM for email in your custom domain](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure) - [Google Workspace Admin Help: Set up DKIM](https://knowledge.workspace.google.com/admin/security/set-up-dkim) - [Twilio SendGrid Docs: How to set up domain authentication](https://www.twilio.com/docs/sendgrid/ui/account-and-settings/how-to-set-up-domain-authentication) - [Fastmail Help: Manual DNS configuration](https://www.fastmail.help/hc/en-us/articles/360060591153-Manual-DNS-configuration) - [Amazon SES Developer Guide: Creating and verifying identities](https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html) - [RFC 8301: Cryptographic Algorithm and Key Usage Update to DKIM](https://www.rfc-editor.org/rfc/rfc8301.html) ## Free tools for this guide - [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength. - [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser. - [DKIM Key Generator](https://iblockspam.com/tools/dkim-generator): Create a DKIM key pair and the DNS TXT record for your selector — keys are generated in your browser. - [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test): Send one email and see its SPF, DKIM and DMARC results, reverse DNS, blocklists, TLS and spam verdict. --- Source: iBlockSpam, https://iblockspam.com/blog/find-dkim-selector (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt