DKIM Selectors Explained: How to Find and Use Them

A DKIM selector is a string that identifies which DKIM key to use when verifying an email signature. It's the first part of the DNS record location where your public key is stored.

What is a DKIM Selector?

When a mail server signs an email with DKIM, it includes a s= tag in the signature header that specifies the selector. The receiving server uses this to know where to look up the public key.

For example, if your selector is google and your domain is example.com, the public key is stored at:

google._domainkey.example.com

The full DNS lookup path follows this pattern:

{selector}._domainkey.{domain}

Why Selectors Exist

Selectors allow you to:

Common Selector Examples

How to Find Your DKIM Selector

Method 1: Check Email Headers

Open an email sent from your domain and view the full headers. Look for DKIM-Signature and find the s= tag:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google;

In this example, the selector is google.

Method 2: Ask Your Email Provider

Your email service documentation will specify which selector(s) they use:

• Google Workspace: Uses google by default
• Microsoft 365: Uses selector1 and selector2
• Third-party services: Listed in their DKIM setup instructions

Method 3: DNS Lookup

If you know the possible selectors, query DNS directly:

dig TXT google._domainkey.example.com

Or use an online DKIM lookup tool with your domain and suspected selector.

Selector Naming Best Practices

When creating your own DKIM keys, choose selectors wisely:

Do:

• Use descriptive names like mailchimp, crm, or transactional
• Include the year for rotation tracking: 2026q1
• Keep it lowercase and alphanumeric

Don't:

• Use special characters (stick to letters, numbers, hyphens)
• Make selectors too long (keep under 63 characters)
• Use obvious names that reveal internal systems if security is a concern

Multiple Selectors

Most domains use multiple selectors:

google._domainkey.example.com     (Google Workspace)
selector1._domainkey.example.com  (Office 365)
k1._domainkey.example.com         (Mailchimp)

This is normal and expected. Each selector points to a different public key for a different signing service.

Selector and Key Rotation

When rotating DKIM keys:

Troubleshooting Selector Issues

"DKIM record not found"

• Verify the selector name matches exactly (case-sensitive in some systems)
• Check DNS propagation has completed
• Confirm the full path: selector._domainkey.domain.com

"DKIM signature verification failed"

• The selector in the email header doesn't match the DNS record
• Key was rotated but emails are still being signed with the old selector

---

DKIM Creator generates keys with your custom selector names, ready to deploy.