Blog
What is a DKIM selector?
Reviewed by the Free Domain Mail editorial team · Updated
A DKIM selector identifies which public key a sender used. It appears before ._domainkey in the DNS hostname and must match the selector in the message signature.
Read the selector
For selector1._domainkey.example.com, the selector is selector1 and the signing domain is example.com.
Providers may issue several selectors for key rotation or separate sending systems.
Check the right record
Enter both the domain and exact selector in DKIM Checker. The record may be TXT or a CNAME to the provider.
A published key does not prove outgoing messages use it; confirm the DKIM-Signature header on a real message.
Common mistakes to avoid
- Changing production DNS before recording the current values.
- Assuming a DNS record guarantees inbox placement.
- Testing before the previous TTL has expired.
Frequently asked questions
Can a checker discover every selector?
No. Selectors are not reliably enumerable in DNS; obtain one from the provider or a message header.
Are underscores valid here?
The _domainkey label is part of the DKIM DNS convention.
Technical references
Primary specifications and provider documentation relevant to this guide: