DKIM Selectors Explained: What They Are and How to Find Yours

A DKIM selector is a string used to locate your domain's DKIM public key in DNS. It's part of the DKIM-Signature header added to outgoing email. When a receiving server validates DKIM, it combines the selector with your domain to construct a DNS query.

If your selector is 'google' and your domain is example.com, the receiving server queries: google._domainkey.example.com

The result is a TXT record containing your public key, which the server uses to verify the email's signature.

Method 1: Email headers — Send a test email and view the raw headers. Look for the DKIM-Signature header. It contains s=selector_name (e.g., s=google or s=selector1).

Method 2: Ask your email provider — Google Workspace, Microsoft 365, SendGrid, and others publish their selector names in their setup documentation.

Method 3: DNS lookup — If you know the selector, query selector._domainkey.yourdomain.com for a TXT record.

Common selectors by provider: - Google Workspace: google, google2 - Microsoft 365: selector1, selector2 - SendGrid: s1, s2, smtpapi - Mailchimp: k1, k2 - Mailgun: mailo, pic, smtp

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=yourdomain.com; s=google;
        h=mime-version:from:date:message-id:subject:to;
        bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;
        b=Vm9CIpZNknZHarXSy3IHidLCNhlkzELTbVAXwM3XHj
         nJwkQEL3gL0uO7Zf5kHN5y1dP5IYcVQBvFAMNpT0DJHG
         WqHiXK0Rv9UZRdVKx8V2zTj0jnGQ2X7Vk7I+4tYfuP0=

# Key fields explained:
# v=1        — DKIM version
# a=rsa-sha256 — signing algorithm
# c=relaxed/relaxed — canonicalization (header/body)
# d=yourdomain.com — signing domain (must align with From: for DMARC)
# s=google   — selector (look up: google._domainkey.yourdomain.com)
# h=         — list of signed headers
# bh=        — hash of the canonicalized message body
# b=         — the actual cryptographic signature

You can have multiple DKIM selectors for the same domain — in fact, you should. Each email service that sends on behalf of your domain should have its own selector and key pair.

This allows: independent key rotation per service, specific revocation if one service is compromised, and clear attribution of which service signed each email.

To add a new selector, generate a key pair in your email service's settings, then add the public key as a TXT record at newselector._domainkey.yourdomain.com.

DKIM keys should be rotated periodically (annually at minimum, every 6 months for high-security environments). Rotation process: 1. Generate a new key pair in your email service 2. Publish the new public key in DNS at a new selector 3. Configure your email service to sign with the new key 4. Wait for DNS propagation (usually 1-48 hours) 5. Verify signing works with the new selector 6. Keep the old selector active for 30+ days (messages already in transit may still use it) 7. Remove the old selector from DNS

Never delete an old DKIM record immediately — emails in transit or in recipient archives that are later verified could fail.