A DKIM selector identifies which public key a sender used. It appears before ._domainkey in the DNS hostname and must match the selector in the message signature. Selectors let one domain publish several keys at once, one per sending service or per key generation, so a receiver always knows which key to fetch. This guide shows where to find the selector, how to check its record and what to do when the check fails.
Read the selector
For selector1._domainkey.example.com, the selector is selector1 and the signing domain is example.com.
Providers may issue several selectors for key rotation or separate sending systems. A domain that sends through Google Workspace and a newsletter service will often have two or more selectors live at the same time.
Find it in a message header
Open the original source of a message you sent and find the DKIM-Signature header. The s= tag is the selector and the d= tag is the signing domain. The receiver looks up s._domainkey.d in DNS to fetch the public key.
If d= shows the provider's domain instead of yours, that service is signing with its own domain and DKIM will not align with your From address for DMARC.
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=example.com; s=google;
h=from:to:subject:date; bh=…; b=…
→ DNS lookup: google._domainkey.example.comCommon selectors by provider
Google Workspace uses google by default unless an administrator chose another prefix. Microsoft 365 uses selector1 and selector2, published as CNAME records that point to keys hosted by Microsoft. Amazon SES Easy DKIM uses three long random tokens. Many newsletter tools use names like k1, s1 or mte1.
These are typical defaults, not guarantees. Always copy the exact selector from the provider's admin console or a real header.
google._domainkey.example.com TXT v=DKIM1; k=rsa; p=MIIBIjANBgkq…
selector1._domainkey.example.com CNAME (target shown in Microsoft 365)
selector2._domainkey.example.com CNAME (target shown in Microsoft 365)Check the right record
Enter both the domain and exact selector in DKIM Checker. The record may be TXT or a CNAME to the provider.
A TXT key record starts with v=DKIM1, names the key type with k=rsa (or ed25519) and carries the public key in p=. An empty p= means the key has been revoked.
A published key does not prove outgoing messages use it; confirm the DKIM-Signature header on a real message.
Troubleshooting a failing selector
No record found: check for a doubled domain such as google._domainkey.example.com.example.com, which happens when the full name is typed into a field that appends the domain.
Key found but dkim=fail: the key may have been rotated at the provider, or a long key was split badly into several strings. Republish the value exactly as the provider shows it and wait for the TTL. Read what DKIM is for the basics and check DMARC alignment with the Email Health Check.
Common mistakes to avoid
- Guessing a selector instead of copying it from the provider or a header.
- Typing the full hostname into a DNS field that appends the domain automatically.
- Deleting an old selector while a service still signs with it.
- Turning on a CNAME proxy at the DNS provider for a DKIM record.
- Assuming a published key means messages are actually being signed.
Frequently asked questions
Can a checker discover every selector?
No. Selectors are not reliably enumerable in DNS; obtain one from the provider or a message header.
Are underscores valid here?
The _domainkey label is part of the DKIM DNS convention.
Can I have more than one selector?
Yes. Each sending service can have its own selector, and providers publish two or more during key rotation.
Should DKIM be TXT or CNAME?
Either, depending on the provider. CNAME lets the provider host and rotate the key; TXT means you publish the key yourself.
When can I remove an old selector?
Only after no messages are signed with it, plus a few days for mail still in transit.