DKIM Selector Guide: How to Find and Check a Selector
A DKIM selector identifies which public key a receiver should retrieve for a signed message. Unlike SPF and DMARC records, DKIM selectors cannot generally be discovered by asking DNS for every possible selector.
Where the selector comes from
A DKIM-Signature header contains an s= tag. That value is the selector used for the signature. The d= tag provides the signing domain.
Together these values identify the DNS location used for the DKIM public key.
DKIM DNS name format
The selector is placed before _domainkey and the signing domain. A selector named selector1 for example.com is therefore queried under selector1._domainkey.example.com.
Because administrators can choose many different selector names, there is no universal DNS query that reliably discovers every DKIM selector.
How to find a selector from a message
Open the raw headers of a message that was sent by the domain and inspect the DKIM-Signature header. Look for the d= signing domain and s= selector.
An email header analyzer can extract these authentication fields more conveniently when a full raw header block is available.
What to inspect after finding it
Check whether the selector resolves, whether the DKIM record is syntactically valid, whether a public key is present and whether the key can be decoded.
A missing selector is different from proving that a domain has no DKIM configuration at all.
Free email diagnostics
FreeMailCheck provides free tools for SPF, DKIM, DMARC, DNS, SMTP, TLS, reverse DNS, email headers and sender compliance.
Browse all 61 tools →