What Is My DKIM Selector? How to Find It (Provider Lookup Table)

If you’re here, you probably hit a tool that asked for a “selector” and had no idea what to type. Short answer: the selector is a label your email provider picked, and it forms part of the DNS name where your public key lives.

DKIM keys are published at <selector>._domainkey.yourdomain.com. Without the selector there’s nothing to look up — which is why generic “check my DKIM” tools so often report DKIM as missing when it’s working fine. For the conceptual background, see What is a DKIM selector? (and why “DKIM missing” is often wrong). This page is the practical lookup.

Default selectors by provider

Most providers use a predictable default. Try these first — providers do occasionally change or rotate them, so treat this as a starting point.

The quickest way to confirm: put the domain and a candidate selector into the free DKIM checker. If the key resolves, that’s your selector.

If your provider isn’t listed

Method 1: read a sent email’s headers (most reliable)

This works regardless of provider, because the selector is stamped into every signed message.

1. Send an email from the domain to yourself.
2. Open the raw source. In Gmail: the three-dot menu → Show original. In Outlook: File → Properties → Internet headers.
3. Search for DKIM-Signature.
4. Find the s= tag. That is your selector. The d= tag next to it is the signing domain.

A signature reading s=selector1; d=yourdomain.com means the selector is selector1.

Method 2: query DNS directly

If you have a candidate and just want to confirm it:

dig TXT selector1._domainkey.yourdomain.com +short

On Windows: nslookup -type=TXT selector1._domainkey.yourdomain.com. A response starting v=DKIM1 means you found it.

Method 3: check your DNS records for CNAMEs

Many providers have you add CNAMEs rather than TXT records. Scan your DNS zone for anything containing _domainkey— the part before it is the selector.

Why you may have several — and should

Every service that sends as your domain signs with its own selector. A typical company legitimately has Google Workspace on google, a marketing platform on k1, and a billing system on its own token, all at once. Selectors exist precisely so these don’t collide.

This is also the most common false alarm in deliverability: a checker looks up one default selector, finds nothing, and declares DKIM broken. Always confirm against the s= value in a real message before you go changing DNS.

Checking every sender at once

Finding one selector is a five-minute job. Keeping track of every selector, across every sending service, across every client domain — and noticing when one stops resolving after a provider migration — is not. Zeqo Mail checks known selectors on a schedule and alerts you when a previously working key disappears.

Next: free DKIM checker · SPF, DKIM & DMARC explained