How to Find Your DKIM Selector (and Check or Rotate It)

Most DKIM checkers ask for a "selector" before they'll tell you anything, and most people have no idea what theirs is. The selector is simply the label that tells receiving mail servers where in your DNS to find the public key for your signatures. This guide shows how to find your DKIM selector in about two minutes from any email you've sent, lists the selectors the big providers use, and explains how to check the key and rotate it safely.

What a DKIM selector is

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The receiving server checks that signature against a public key published in your DNS. If you're new to DKIM, our guide to what DKIM is covers the basics.

A domain can have many DKIM keys at once, one for Google Workspace, another for Mailchimp, another for your invoicing system, so each one needs a name. That name is the selector. The public key lives at:

<selector>._domainkey.<your-domain>

So if your selector is google and your domain is example.com, the key is a TXT record at google._domainkey.example.com.

There's no way to list every selector a domain uses from DNS alone. You have to know the name, which is why checkers either ask you for it or try a list of common ones.

Method 1: Find the selector in an email header (most reliable)

Every DKIM-signed email carries a DKIM-Signature header that names the selector in its s= tag. This works for any provider.

1. Send an email from the account or service you want to check to a personal Gmail or Outlook address.
2. Open the full headers:
   • Gmail: open the message, click the three dots, choose Show original.
   • Outlook (web): open the message, click the three dots, choose View > View message source.
   • Outlook (desktop): open the message, then File > Properties and look under Internet headers.
   • Apple Mail: View > Message > All Headers.
3. Find the line that starts DKIM-Signature: (use Ctrl+F or Cmd+F).
4. Read two tags: d= is the signing domain and s= is the selector.

A typical header looks like this:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=example.com; s=google;
        h=from:to:subject:date:message-id;
        bh=...; b=...

Here the selector is google, and the key lives at google._domainkey.example.com.

Things to watch for:

• Several DKIM-Signature headers are normal. Your provider may sign with your domain and its own (for example d=yourdomain and d=sendgrid.net). For DMARC, the one that matters is the signature whose d= matches, or is a parent of, the domain in your From address.
• Gmail's "Show original" summary shows DKIM: PASS with domain example.com near the top, a quick way to confirm it's working.
• No DKIM-Signature at all means the service isn't signing with DKIM yet. Turn it on in the provider's settings.

Method 2: Common DKIM selectors by provider

If you know who sends your email, you can often guess the selector. These are the defaults, but your account's settings always take priority over generic examples.

Google Workspace

Google's default selector prefix is google, and Google recommends using it unless your domain already has a key with that name. Choose a 2048-bit key if your DNS host supports it; Google suggests 1024-bit only when it doesn't. After enabling Gmail you may need to wait 24 to 72 hours before you can generate the key, and DKIM can take up to 48 hours to start working after you publish the TXT record.

Microsoft 365

Microsoft 365 always uses two selectors, selector1._domainkey and selector2._domainkey, published as CNAME records pointing at Microsoft. Newer tenants get targets in the format:

selector1-example-com._domainkey.<tenant>.n-v1.dkim.mail.microsoft

Older tenants may point at ...<tenant>.onmicrosoft.com instead. Copy the exact values from the Defender portal or the Get-DkimSigningConfig PowerShell command rather than typing them by hand. Notice that in Microsoft 365 email headers, the s= value looks like selector1-example-com, but the DNS record you create on your own domain is still named selector1._domainkey.

Until you enable DKIM for your custom domain, Microsoft signs with your onmicrosoft.com domain, which won't align with your From address for DMARC.

Mailchimp

Mailchimp asks for two CNAME records shown in Domains when you authenticate a domain, typically k2._domainkey and k3._domainkey pointing at mcsv.net hosts. Mailchimp notes that some DNS providers automatically append your domain to the name, so you may need to enter only k2._domainkey rather than the full hostname.

SendGrid

With Automated Security switched on (the default), SendGrid gives you CNAME records for s1._domainkey and s2._domainkey that point at SendGrid-managed hosts. Because SendGrid controls the records behind those CNAMEs, it can manage the keys without you republishing anything.

cPanel hosting

If you send through your web host's mail server, cPanel's Email Deliverability tool usually publishes a TXT record at default._domainkey. If your DNS is hosted elsewhere (for example at Cloudflare), cPanel can't install it for you: copy the suggested record into your DNS provider.

Method 3: Ask the DNS directly

Once you have a candidate selector, query it:

# macOS / Linux
dig +short TXT google._domainkey.example.com

# Windows PowerShell
Resolve-DnsName -Type TXT google._domainkey.example.com

For CNAME-based selectors (Microsoft 365, Mailchimp, SendGrid), query the CNAME first or let the resolver follow it.

A valid key looks like v=DKIM1; k=rsa; p=MIIBIjANBgkqh.... If the p= tag is empty (p=;), the key has been revoked, and mail signed with that selector will fail DKIM.

Checking your DKIM selector with our tool

Our free DKIM checker looks up the TXT record at <selector>._domainkey.<domain>. If you enter a selector it checks that one; if you leave it blank it tries a list of common selectors, including google, selector1, selector2, k1, k2, s1, s2 and default. It shows any key it finds and flags selectors whose key has been revoked with an empty p= tag. You need a free account to run it.

DKIM is only one of three records receivers check. Use the SPF checker and DMARC checker alongside it, or the email deliverability checker to review them together. Our email authentication checklist walks through the full setup.

How to rotate DKIM keys safely

Rotating keys limits the damage if a private key is ever exposed. M3AAWG, the industry anti-abuse group, recommends rotating DKIM keys at least every six months, and immediately if you suspect a key has been compromised.

The safe pattern uses two selectors so there's never a moment without a valid key:

1. Publish a new key under a new selector (for example google2026) while the old one stays in DNS.
2. Switch signing to the new selector in your provider once the new record resolves.
3. Wait for mail signed with the old key to finish being delivered and checked. A week or more is a sensible buffer.
4. Revoke the old key by setting its record to an empty p= value, or remove it later.

Rotation on the main platforms

• Microsoft 365: rotation is built in. Run Rotate-DkimSigningConfig -Identity example.com, optionally with -KeySize 2048, or use the rotate option in the Defender portal. Microsoft says the new key takes four days (96 hours) to start signing, and you can't start another rotation in the meantime. Your two CNAME records stay the same.
• Google Workspace: generate a new record with a different selector prefix, publish the TXT record, wait for it to resolve, then start authentication with the new key. Remove the old record afterwards.
• SendGrid and Mailchimp: because you publish CNAMEs that point to the provider, key management happens on their side.
• cPanel: some hosts let you regenerate the key in Email Deliverability. Make sure the new TXT record is published before the old one is removed, especially if DNS is hosted outside cPanel.

Frequently asked questions

What is a DKIM selector?

It's a name that tells receiving mail servers where to find your DKIM public key in DNS, at <selector>._domainkey.<yourdomain>. It lets one domain have separate keys for different sending services.

How do I find my DKIM selector?

Open the full headers of an email you sent, find the DKIM-Signature line and read the s= tag. The d= tag next to it shows which domain signed the message.

What is the DKIM selector for Google Workspace?

The default is google, so the record lives at google._domainkey.yourdomain. You can choose a different prefix when generating the key, for example if google is already in use.

What are selector1 and selector2 in Microsoft 365?

They're the two DKIM selectors Microsoft 365 uses for every custom domain, published as CNAME records pointing to Microsoft. Having two lets Microsoft rotate keys by switching between them without changing your DNS.

Can I have more than one DKIM selector?

Yes. Each sending service should have its own selector and key, such as google for Workspace and k2 and k3 for Mailchimp. They don't conflict because each lives at a different DNS name.

How often should I rotate DKIM keys?

M3AAWG recommends rotating at least every six months, and straight away if a key may have been exposed. Use a new selector for the new key so there's no gap in signing.

Sources

• Microsoft Learn: How to use DKIM for email in your custom domain
• Google Workspace Admin Help: Set up DKIM
• Mailchimp: About email domain authentication
• Twilio SendGrid: How to set up domain authentication
• cPanel: Email Deliverability
• M3AAWG: DKIM Key Rotation Best Common Practices
• RFC 6376: DomainKeys Identified Mail (DKIM) Signatures