How to find your DKIM selector
Every DKIM key lives at a selector, and DNS will not list them. How to read it from a message header, plus verified selectors for 14 common email providers.
The quickest way to find your DKIM selector is to send yourself an email and read its headers. Look for the DKIM-Signature header: the s= value is the selector and the d= value is the domain that signed the message. Together they tell you exactly where the public key lives in DNS, and whether that signature can help you pass DMARC.
What a selector is
DKIM (DomainKeys Identified Mail) signs each outgoing message with a private key, and publishes the matching public key in DNS so receivers can check the signature. A domain can have many keys at once, one for each service that sends on its behalf, plus spares for rotation. The selector is the name that tells a receiver which key to fetch.
The key always lives at this address:
selector._domainkey.yourdomain.com
So a message signed with s=google and d=yourdomain.com has its public key at google._domainkey.yourdomain.com.
Why you cannot just look it up
DNS answers questions about names you already know. It has no way to list every name under _domainkey for a domain, so there is no lookup that returns “all of this domain’s selectors”. That is why our DKIM checker asks you for a selector rather than guessing one.
Some tools work around this by trying a list of common selectors. Inspect My DNS, for example, probes the selectors the big providers use and reports any keys it finds. Run it against dmarc.expert and it finds selector1 and selector2, the Microsoft 365 pair. That is useful for a quick survey, but a probe can only find selectors on its list. If a sender uses a custom or randomly generated selector, the header is the only reliable source.
Reading the selector from a message header
Send a message from the system you want to check, to a mailbox you can read, then open the full headers:
- Gmail: open the message, click the three-dot menu and choose Show original.
- Outlook on the web: open the message, click the three-dot menu and choose View then View message source.
- Outlook desktop: open the message, then File, Properties, and read the Internet headers box.
- Apple Mail: open the message and choose View, Message, All Headers.
Find the line that starts with DKIM-Signature. A trimmed example:
DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=selector1; h=from:to:subject:date; bh=...; b=...
Two tags matter here:
s=selector1is the selector.d=yourdomain.comis the signing domain.
A message can carry more than one DKIM-Signature header. That is normal, particularly with marketing platforms, which often sign once with your domain and once with their own. Note each pair of s= and d=.
The selectors common providers use
These are the selectors each platform tells you to publish, checked against the provider’s own setup documentation and against live DNS in October 2026. Where a provider publishes CNAMEs, the record at your domain points to a key the provider hosts and rotates for you. Providers do change their setups, so treat this as a guide and confirm against a real message header.
| Provider | Selectors you publish | Record type | Points to (CNAMEs) |
|---|---|---|---|
| Microsoft 365 | selector1, selector2 | CNAME | selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com, or the newer format below |
| Google Workspace | google (you can choose another prefix) | TXT | |
| Mailchimp | k2, k3 | CNAME | dkim2.mcsv.net, dkim3.mcsv.net |
| Mailchimp Transactional | mte1, mte2 | CNAME | dkim1.mandrillapp.com, dkim2.mandrillapp.com |
| SendGrid (Twilio) | s1, s2 | CNAME | s1.domainkey.u1234567.wl123.sendgrid.net (numbers vary per account) |
| Amazon SES (Easy DKIM) | Three random tokens | CNAME | token.dkim.us-west-2.amazonses.com (region varies) |
| Mailgun (automatic security) | pdk1, pdk2 | CNAME | pdk1._domainkey.<id>.dkim1.mailgun.com |
| Postmark | A dated selector such as 20230601123456pm | TXT | |
| Zendesk | zendesk1, zendesk2 | CNAME | zendesk1._domainkey.zendesk.com, zendesk2._domainkey.zendesk.com |
| Klaviyo (static routing) | km1/km2 marketing, kt1/kt2 transactional | CNAME | Values shown in your Klaviyo account |
| Constant Contact | ctct1, ctct2 | CNAME | Values shown in your Constant Contact account |
| Fastmail | fm1, fm2, fm3 | CNAME | fm1.yourdomain.com.dkim.fmhosted.com (and fm2, fm3) |
| Proton Mail | protonmail, protonmail2, protonmail3 | CNAME | protonmail.domainkey.<id>.domains.proton.ch (and 2, 3) |
| Zoho Mail | A selector you choose, such as zoho | TXT |
A few details worth knowing:
- Microsoft 365 changed its CNAME targets for custom domains added from May 2025. Newer domains point to
selector1-yourdomain-com._domainkey.yourtenant.n-v1.dkim.mail.microsoft(the letter before-v1varies), while older domains keep theonmicrosoft.comform. Do not guess either one: the Defender portal shows the exact values, or runGet-DkimSigningConfig -Identity yourdomain.com | fl Selector1CNAME,Selector2CNAMEin Exchange Online PowerShell. - Mailchimp setups from before
k2andk3may still have a legacyk1record pointing todkim.mcsv.net. - Amazon SES generates its tokens per identity, so there is no fixed name to look for. Its keys are 2048-bit by default.
- Mailgun rotates automatic-security keys every 120 days. If you configured DKIM manually, the selector is whatever you chose.
- HubSpot asks for two CNAMEs and shows the host names in your account. On hubspot.com itself they are
hs1andhs2, but check your own account rather than assuming.
Groups of selectors like selector1 and selector2, or Fastmail’s three, exist so a provider can rotate keys: it publishes the new key at an idle selector, switches signing over, then retires the old one, with no gap in between.
Check the d= domain, not just the selector
Finding a valid key is only half the job. For DKIM to count toward DMARC, the d= domain has to align with the domain in your visible From address. If you send as you@yourdomain.com but the signature says d=sendgrid.net or d=yourtenant.onmicrosoft.com, DKIM passes and DMARC still ignores it, because the signature vouches for the provider, not for you.
That is one of the most common reasons a sender fails DMARC despite “having DKIM”. The fix is usually to set up custom DKIM in the provider’s dashboard, which gives you DNS records to publish so that it signs as your own domain. We walk through it in getting SPF and DKIM aligned, and explain the underlying idea in what DMARC alignment really means.
What to check once you have the selector
Put the selector and domain into the DKIM checker and look at three things:
- The key exists. If the lookup returns nothing, the DNS record was never published, was deleted, or has a typo. A CNAME that points nowhere counts as missing.
- The key is long enough.
RFC 8301sets 1024 bits as the minimum for RSA keys and recommends 2048. Many receivers treat shorter keys as no signature at all. - The key is not revoked. A record with an empty
p=tag is a deliberately revoked key. Fastmail’s ownfm3selector is a real example, left blank between rotations. That is fine for an idle selector, but not for one that is still signing mail.
Do this for every service that sends as your domain, not just your main mailbox. Your DMARC aggregate reports list each sending source and whether its DKIM passed and aligned, which makes them the best checklist of which selectors you actually need to check. If you are not collecting reports yet, start with p=none and they will show you.