Reference

DKIM selector: what it is and how to find yours

What a DKIM selector is, where to find yours in a message header or your provider's console, and the selectors Google, Microsoft and others use.

By Updated Last verified

On this page
  1. What a selector does
  2. How to find your selector
  3. Selectors by provider
  4. Two real examples
  5. Why a checker might not find your key
  6. Sources

A DKIM (opens in a new tab) (DomainKeys Identified Mail) selector is a name that lets one domain publish several DKIM keys at once. RFC 6376 (opens in a new tab) says the key namespace is subdivided using selectors, and each signature names its selector in the s= tag (opens in a new tab). To find yours, read the s= value in the DKIM-Signature header of a message you sent; the selectors by provider table below lists common ones.

What a selector does

Selectors (opens in a new tab) exist to support multiple concurrent public keys per signing domain. The signature is stored in the DKIM-Signature header (opens in a new tab): its d= tag names the domain, and its s= tag names the selector within that domain.

The two together give the DNS name of the public key. All DKIM keys sit under _domainkey (opens in a new tab), so a signature with d=example.com and s=selector1 means a DNS query for selector1._domainkey.example.com.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

How to find your selector

The DKIM-Signature header (opens in a new tab) of any message you sent carries the selector in s=. Microsoft's DKIM guide (opens in a new tab) gives the same tip: check the s= value in the DKIM-Signature header field, for example s=selector1-contoso-com.

The other place is your provider's setup screen. As the DemiSignal check page puts it, your provider's admin console shows the selector it uses.

Selectors by provider

Each provider documents its own selector names:

Provider Selector Source
Google Workspace google (the default prefix) Google's DKIM setup (opens in a new tab)
Microsoft 365 selector1 and selector2; only one is active. New custom domains since May 2025 point them at a -v1.dkim.mail.microsoft target Microsoft's DKIM guide (opens in a new tab)
Klaviyo Depends on send type: km1/km2 (marketing), kt1/kt2 (transactional), ks1/ks2 (service) Klaviyo's branded sending domain guide (opens in a new tab)
SendGrid s1 and s2 by default; one active at a time Twilio's DKIM records guide (opens in a new tab)
Zoho Mail A name you choose, for example zoho Zoho's DKIM configuration (opens in a new tab)
OpenDKIM Any name you choose OpenDKIM's README (opens in a new tab)

With Zoho, a selector named zoho on example.com means a TXT record at zoho._domainkey.example.com. With OpenDKIM, the public key record should appear as a TXT record named after your selector under _domainkey in your domain.

Step-by-step setup: Google Workspace, Microsoft 365, Klaviyo, SendGrid, Zoho Mail, Postfix and OpenDKIM.

Two real examples

Checked against live DNS: microsoft.com publishes both of its selectors as CNAMEs. selector2._domainkey.microsoft.com points to selector2-microsoft-com._domainkey.microsoft.onmicrosoft.com, which returns a DKIM key starting v=DKIM1; k=rsa; p=.

The target of selector1._domainkey.microsoft.com, selector1-microsoft-com._domainkey.microsoft.onmicrosoft.com, returns no record (NXDOMAIN). Microsoft (opens in a new tab) documents that only one of the two selectors is active at a time.

demisignal.com publishes a key under the selector google, at google._domainkey.demisignal.com, as a TXT record starting v=DKIM1;k=rsa;p=.

Why a checker might not find your key

DKIM keys sit under selector names your provider chooses. The DNS check tries commonly used selectors; if your provider uses a different one, the key is there but the check cannot see it. In that case, find the selector in your provider's admin console, which shows the selector it uses. If signatures fail rather than go missing, see DKIM fail; for how DKIM fits with SPF and DMARC, see SPF vs DKIM vs DMARC.

Sources

Tools for this

Frequently asked questions

What is a DKIM selector?

A name that subdivides a domain's DKIM keys, so one domain can publish several keys. The selector is the s= value in the DKIM-Signature header, and the key lives at selector._domainkey.yourdomain.

Where do I find my DKIM selector?

Look at the s= value in the DKIM-Signature header of a message you sent, or in your email provider's admin console.

Can a domain have more than one selector?

Yes. Selectors exist so a domain can have several keys at once; Microsoft 365 and SendGrid each publish two and use one at a time.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account