What Is a DKIM Selector, and How Do You Find Yours?

A DKIM selector is the name of the key that signed an email. Every DKIM signature carries it in the s= tag, next to the signing domain in d=, and the receiver uses the two to fetch the public key from DNS at <selector>._domainkey.<domain>. To find yours, open an email you sent, show the original, and read s= in the DKIM-Signature header. That's the only reliable way: DNS has no command that lists a domain's selectors, so every "selector finder" is guessing from a list.

Below: where the selector lives in a real email, how to look the key up, the default selectors of the common providers (checked on real domains on 25 October 2026), and what to do when no selector turns up.

What does a DKIM selector do?

It lets one domain publish several DKIM keys at the same time. RFC 6376 calls it a way "to support multiple concurrent public keys per signing domain": your mailbox provider signs with one key, your newsletter tool with another, your help desk with a third, and none of them has to share a private key with the others.

The selector also makes key rotation possible. You publish a new key under a new selector, switch signing to it, and remove the old record once mail signed with it has stopped arriving. The RFC recommends a new selector for each new key rather than reusing an old name.

In DNS it's just a label in front of _domainkey:

google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

google is the selector, example.com the domain, and the p= value is the public key.

How do I find my DKIM selector?

Send yourself an email from the mailbox or tool you want to check, then read its headers.

In Gmail: open the email, click the three dots next to Reply, choose Show original. The summary at the top shows DKIM: 'PASS' with domain example.com. Below it, find the DKIM-Signature header:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=example.com; s=google;
        h=to:subject:message-id:date:from:mime-version;
        bh=...; b=...

d=example.com is the signing domain and s=google is the selector. The Authentication-Results header repeats it as header.s=google.

In Outlook: open the email, then File > Properties (desktop) or the three dots > View > View message source (web) and search for s=.

An email can carry more than one DKIM-Signature header. That's normal: your provider and a sending service can both sign. The one that matters for DMARC is the signature whose d= matches the domain in your From address.

How do I look up a DKIM record once I know the selector?

Query the TXT record at <selector>._domainkey.<domain>:

dig +short TXT google._domainkey.example.com

On Windows, nslookup -type=TXT google._domainkey.example.com does the same. If you get a v=DKIM1 record with a p= value, the key is published. Some providers publish a CNAME instead of a TXT record, pointing at a key they host and rotate for you; dig follows it and prints the target first, then the key.

Or put the domain and selector into our DKIM checker: it reads the record, says whether the key parses, and checks SPF and DMARC in the same run.

Can you find a DKIM selector without an email?

Only by guessing. DNS answers questions about names you already know; there is no query that returns every name under _domainkey. Lookup tools try a list of common selectors and report the ones that answer. Ours tries 23 (the defaults below plus generic names like default, mail and dkim), and some tools try a hundred or more. A custom selector such as 2026q4 or s9f3k won't be found by any of them.

So if a tool says "no DKIM record found", it means none of its guesses answered. Check the headers of a real email before you conclude DKIM is missing.

What are the default DKIM selectors by provider?

These are the selectors each provider uses unless you change them. We checked the record type on real domains on 25 October 2026.

github.com is a good picture of a busy domain: on the day we checked it published six selectors for four different senders (Google, Microsoft, SendGrid and Mailchimp). Every service that sends as your domain needs its own.

Why is no DKIM record found for my selector?

In the order we see them:

1. DKIM was never turned on. Google Workspace doesn't sign with your domain until an admin generates the key and clicks Start authentication (Admin console > Apps > Google Workspace > Gmail > Authenticate email). Until then Google signs with its own domain, ending in gappssmtp.com, so DKIM passes but doesn't align with your From address. Microsoft 365 is similar: the two CNAMEs do nothing until DKIM is enabled for the domain in the Defender portal.
2. The record is at the wrong name. Some DNS panels add your domain to every name you type. Entering google._domainkey.example.com there creates google._domainkey.example.com.example.com. Enter google._domainkey only.
3. The key got split or cut. A 2048-bit key is longer than 255 characters, the most one TXT string can hold. Most DNS panels split it for you; some cut it off. If dig shows a p= value that ends early, paste it again.
4. You're looking up the wrong selector. Your header says s=selector1 and you're checking google. Read the header first.
5. DNS hasn't caught up. A new record can take from minutes to the record's TTL to show everywhere.

Does the selector affect deliverability?

The name doesn't. What matters is that the signature verifies and that its d= domain aligns with your From domain, because that's what DMARC checks. Gmail and Yahoo ask bulk senders for SPF, DKIM and DMARC with an aligned From domain, and Outlook.com rejects high-volume mail that fails them with 550 5.7.515.

For cold email this has a practical side. Each sending domain needs its own DKIM key, set up in its own mailbox provider. When you add ten new domains on Google Workspace, that's ten keys to generate and ten Start authentication clicks, and the one you forget is the one that drags its mailboxes into spam.

When this guide isn't enough

If headers show DKIM passing and aligned, and mail still lands in spam, DKIM isn't your problem. Look at the list (bounces), the volume per mailbox, and the copy. A valid signature proves who sent an email. It says nothing about whether anyone wanted it.

How Ballast checks it

Ballast's free domain check tries the 23 common selectors on any domain, plus one you type, and reports each key it finds next to the domain's SPF, DMARC and blacklist results. Inside the app, every sending domain gets the same report, rechecked every night, so a key that disappears after a DNS change shows up as a failing check instead of a slow drop in replies. The domains docs show the report.

FAQ

What is a DKIM selector?

A label that names one DKIM key on a domain. It appears as s= in the email's DKIM signature and as the first part of the DNS name <selector>._domainkey.<domain> where the public key is published.

Where do I find my DKIM selector?

In the DKIM-Signature header of an email you sent: open it, choose Show original in Gmail or View message source in Outlook, and read the s= value next to d=.

What is the DKIM selector for Google Workspace?

google by default. Admins can set a different prefix when they generate the key in the Admin console.

What is the DKIM selector for Microsoft 365?

selector1 and selector2. You publish them as two CNAME records that point at keys Microsoft hosts, then enable DKIM for the domain.

Can I have more than one DKIM selector?

Yes, and most domains that use several sending services do. Each service signs with its own selector and key. RFC 6376 designed selectors for exactly that, and for rotating keys.

Can a tool list all DKIM selectors for a domain?

No. DNS can't list the names under _domainkey. Lookup tools try a list of common selectors, so a custom one stays invisible unless you know its name.

Sources

• RFC 6376: DomainKeys Identified Mail (DKIM) Signatures, sections 3.1 and 3.5, checked 25 October 2026.
• Gmail email sender guidelines, checked 16 October 2026.
• Outlook's requirements for high-volume senders, Microsoft Tech Community, checked 16 October 2026.
• Selectors and record types: our own DNS lookups of microsoft.com, github.com, stripe.com, fastmail.com and proton.me on 25 October 2026.