Find Your DKIM Selector

Your DKIM selector is the label that identifies which public key to use for verification. If you need to check your current DKIM setup, rotate keys, or troubleshoot, you first need to know your selector.

A domain can have multiple selectors â€” one for each email service or key pair. There's no master list in DNS; you need to know which selectors to look for.

Method 1: Check Email Headers

The fastest way to find your selector is from an email you've already sent.

Open a sent email in the recipient's inbox

Send a test email and open it in Gmail, Outlook, or another client.

View the full email headers

Gmail: Click three dots â†’ "Show original"
Outlook: File â†’ Properties â†’ Internet Headers
Apple Mail: View â†’ Message â†’ All Headers

Find the DKIM-Signature header

Search for DKIM-Signature and look for the s= tag:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1;
  h=from:to:subject:date; bh=...; b=...

The value after s= is your selector. In this example: selector1.

Method 2: Query DNS Directly

If you know (or can guess) the selector, verify it exists:

# Replace "selector" and "example.com" with your values
dig TXT selector._domainkey.example.com +short

# Or using nslookup
nslookup -type=TXT selector._domainkey.example.com

If a record is returned, that selector is active.

Method 3: Check Your Email Provider

Google Workspace

Default selector: google

Verify: Admin Console â†’ Apps â†’ Google Workspace â†’ Gmail â†’ Authenticate email

dig TXT google._domainkey.yourdomain.com +short

Microsoft 365

Default selectors: selector1 and selector2

Verify: Microsoft Defender â†’ Email authentication â†’ DKIM

dig TXT selector1._domainkey.yourdomain.com +short
dig TXT selector2._domainkey.yourdomain.com +short

SendGrid

Default selectors: s1 and s2

dig TXT s1._domainkey.yourdomain.com +short
dig TXT s2._domainkey.yourdomain.com +short

Mailchimp

Default selector: k1

dig TXT k1._domainkey.yourdomain.com +short

Amazon SES

Selectors vary. Check the SES console under Verified Identities â†’ Your Domain â†’ DKIM.

Postmark

Selectors are date-based, e.g., 20221107

Check the Postmark dashboard under Sender Signatures â†’ Your Domain.

Need a new DKIM key?

Generate keys with your own custom selector name.

Generate Keys

Common Selectors by Provider

Provider	Typical Selector(s)
Google Workspace	`google`
Microsoft 365	`selector1`, `selector2`
SendGrid	`s1`, `s2`
Mailchimp	`k1`
Mailgun	`k1`, `smtp`
Postmark	Date-based (e.g., `20221107`)
Zoho	`zoho`
Amazon SES	Varies
Custom/Self-hosted	Whatever you chose (e.g., `default`, `mail`)

Method 4: Try Common Selectors

If you're not sure which provider is signing, try querying common selectors:

# Try common selectors
for s in default mail google selector1 selector2 s1 s2 k1 zoho dkim smtp; do
  echo "Trying ${s}._domainkey.example.com"
  dig TXT ${s}._domainkey.example.com +short
done

Any selector that returns a record starting with v=DKIM1 is active.

Multiple Selectors

A domain commonly has multiple selectors when using multiple email services:

# Google Workspace
google._domainkey.example.com â†’ v=DKIM1; k=rsa; p=MIIBIj...

# SendGrid
s1._domainkey.example.com â†’ v=DKIM1; k=rsa; p=MIGfMA0...

# Custom application
app._domainkey.example.com â†’ v=DKIM1; k=rsa; p=MIIBIjA...

Each service signs with its own selector, and they coexist without conflict.

Troubleshooting

No DKIM-Signature header in emails DKIM may not be enabled for your domain. Check your email provider's admin settings.

DNS query returns nothing Either the selector is wrong, the record hasn't been published, or DNS hasn't propagated yet.

Multiple DKIM-Signature headers This is normal when email passes through multiple services (e.g., your mail server + a security gateway). Each adds its own signature with its own selector.

Need to generate a key with a specific selector? Use DKIM Creator.

Generate DKIM keys

Choose your own selector name and key size. Free and browser-based.