How to find your DKIM selector (and the defaults of Google, Microsoft and others)
To check a DKIM key you need the selector, and you often don't know it. It's in every signed email, and the common providers use fixed default values. Here is how to find it in a few minutes.
What the selector is
DKIM signs every email with a private key. The public key is published as a TXT record in DNS, under a name of this pattern:
selector._domainkey.example.comThe selector is the first part of that name. It exists so that a domain can have several keys, for example one per sending service, or an old and a new one during a key rotation. You can't simply list a domain's selectors, because DNS has no such list. So you have to know the name or read it from an email.
Way 1: look it up in the email header
This is the most reliable way. Every email signed with DKIM contains a DKIM-Signature header line:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; h=from:to:subject; ...s=is the selector (hereselector1).d=is the signing domain (hereexample.com).
The DNS record is then at selector1._domainkey.example.com.
How to get the header: send yourself an email from the system in question, open it and choose “Show original” (Gmail), “View message source” (Thunderbird) or “Properties › Internet headers” (Outlook). Even simpler: send the email to a Postwacht test address. The report names the selector, domain and key length.
If the email contains several DKIM-Signature lines, it was signed more than once, for example by the sending service and by your mail server. For DMARC, the signature whose d= matches the sender domain counts.
Way 2: providers' default selectors
Many providers use fixed names. These are the common ones you can try if needed:
| Provider | Usual selector |
|---|---|
| Google Workspace | google (freely selectable during setup) |
| Microsoft 365 | selector1 and selector2 (added as CNAME) |
| SendGrid | s1 and s2 |
| Mailchimp | k1 (up to k3) |
| own mail server | often default, mail or dkim |
These are values from experience, not a guarantee. Your provider may prescribe something else, and the setup instructions name the exact name.
Checking the key
With the selector, you can look up the record. The DKIM checker retrieves selector._domainkey.domain, shows the key and checks its length. If you don't enter a selector, it tries the common ones automatically.
A good record looks like this:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...p=holds the public key. An emptyp=means the key has been revoked.- 2048 bits are recommended. 1024 bits are still accepted but weaker.
If nothing is found
- Wrong selector: read it from the header instead of guessing.
- Wrong domain: what counts is
d=in the signature, not necessarily the sender domain. With sending services, it's sometimes their domain. - Record not active yet: after creating it, it takes a while depending on the TTL.
- Doubled domain name: some DNS interfaces append the domain automatically.
selector1._domainkey.example.comthen becomesselector1._domainkey.example.com.example.com. Only enterselector1._domainkey. - The service doesn't sign: some providers only start signing after you've created the record and confirmed it in your account.
Frequently asked questions
Can a domain have several selectors?
Yes, as many as you like. One per sending service is typical, and two at times during a key rotation.
Does the selector have to stay secret?
No. It's in every signed email and in DNS. Only the private key at the sender is secret.
Can I choose the selector myself?
With your own mail servers and some services such as Google Workspace, yes. With others, the provider dictates it.