DKIM Selectors Explained: What They Are and How to Find Yours

If you've tried to set up DKIM or check your DKIM record, you've encountered the selector field. It's a required piece of information that can be confusing at first. This guide explains what selectors are, why they matter, and how to find yours.

What is a DKIM Selector?

A DKIM selector is a name that identifies a specific DKIM public key for your domain. It's part of the DNS record name where your public key is published.

When you look up a DKIM record, you're actually looking up:

[selector]._domainkey.[domain]

For example, if your domain is "example.com" and your selector is "google", the full DNS lookup would be:

google._domainkey.example.com

The selector is what allows you to have multiple DKIM keys for the same domain—each key gets its own selector.

Why Selectors Exist

Selectors solve a practical problem: most businesses use multiple services to send email.

Consider a typical company. They might send email through:

• Google Workspace for employee emails
• Mailchimp for marketing newsletters
• Salesforce for sales notifications
• A custom application for transactional emails

Each of these services needs its own DKIM key. Without selectors, you'd be limited to one key per domain, forcing all services to share the same key (a security nightmare) or preventing DKIM entirely.

With selectors, each service gets its own key:

• google._domainkey.example.com for Google Workspace
• k1._domainkey.example.com for Mailchimp
• sf._domainkey.example.com for Salesforce

Common Selector Names

Different email services use different default selectors. Here are some common ones:

Some services let you choose your own selector name; others assign one automatically. The name itself doesn't affect how DKIM works—it's just an identifier.

How to Find Your DKIM Selector

There are several ways to find the DKIM selector your email service uses.

Method 1: Check Your Email Service's Documentation

The easiest approach. Most email services document their DKIM setup process, including the selector name. Search for "[service name] DKIM setup" and look for the selector in their instructions.

Method 2: Look at Email Headers

Send an email to yourself (or use a service like mail-tester.com) and examine the headers. Look for the DKIM-Signature header:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google;

The s= value is your selector. In this example, it's "google".

Method 3: Check Your Email Service's Admin Console

Most services show your DKIM configuration in their admin settings:

• Google Workspace: Admin Console → Apps → Google Workspace → Gmail → Authenticate email
• Microsoft 365: Microsoft 365 Defender → Policies → DKIM
• Mailchimp: Settings → Domain Authentication

Method 4: Try Common Selectors

If you know which service sends your email, you can try their common selectors using a DKIM lookup tool.

Finding Your Selector by Provider

Here's exactly where to find your DKIM selector in popular email services:

Google Workspace

Selector: google (or google2 after rotation)

1. Go to admin.google.com
2. Navigate to Apps → Google Workspace → Gmail
3. Click Authenticate email
4. Your selector is shown in the DKIM settings (typically "google")

Microsoft 365

Selectors: selector1, selector2

1. Go to the Microsoft 365 Defender portal
2. Navigate to Email & collaboration → Policies & rules → Threat policies
3. Click DKIM under Email authentication settings
4. Select your domain to see which selector is active

Proton Mail

Selectors: protonmail, protonmail2, protonmail3

1. Log into mail.proton.me
2. Go to Settings → Go to settings
3. Navigate to Domain names → select your custom domain
4. Look under DKIM section—your selector is shown with the DNS record
5. Proton typically uses protonmail, protonmail2, or protonmail3

Zoho Mail

Selector: zmail or varies

1. Go to mailadmin.zoho.com
2. Navigate to Domains → select your domain
3. Click Email Configuration → DKIM
4. Your selector is shown with the TXT record value

Mailchimp

Selectors: k1, k2, k3

1. Log into Mailchimp
2. Go to Account → Settings → Domains
3. Click Verify domain or view an authenticated domain
4. The selector is shown with the CNAME records (typically k1)

SendGrid

Selectors: s1, s2 or custom

1. Log into SendGrid
2. Go to Settings → Sender Authentication
3. Click Authenticate Your Domain
4. Your selectors are shown in the DNS records (typically s1 and s2)

Mailgun

Selectors: smtp, mailo, pic, or custom

1. Log into Mailgun
2. Go to Sending → Domain settings
3. Select your domain
4. Look under DNS Records → DKIM for your selector

Amazon SES

Selectors: Unique tokens (varies per account)

1. Log into AWS Console
2. Navigate to Amazon SES → Verified identities
3. Select your domain
4. Under DKIM, you'll see three CNAME records
5. The selector is the first part of each record name (before ._domainkey)

HubSpot

Selectors: hs1, hs2

1. Log into HubSpot
2. Go to Settings → Website → Domains & URLs
3. Click Email Sending Domains
4. Your selectors (hs1, hs2) are shown with the CNAME records

Klaviyo

Selectors: kl, kl2 or similar

1. Log into Klaviyo
2. Go to Settings → Account → Domains
3. Click Sending Domains
4. Your selectors are shown with the DNS records

Salesforce (Marketing Cloud / Pardot)

Selectors: sf, sf2048, or custom

1. Log into Salesforce
2. Navigate to Setup → Email → DKIM Keys
3. Select your domain to view the selector
4. Marketing Cloud and Pardot may use different selectors

Fastmail

Selectors: fm1, fm2, fm3

1. Log into Fastmail
2. Go to Settings → Domains
3. Select your domain
4. Look under Set up MX records for DKIM details

cPanel / WHM

Selector: default (usually)

1. Log into cPanel
2. Go to Email Deliverability (or Email Authentication in older versions)
3. Select your domain
4. The selector is shown in the DKIM configuration (typically "default")

Selector Naming Best Practices

If you can choose your own selector names, follow these guidelines:

Use descriptive names. Names like "mailchimp" or "transactional" are clearer than "key1" or "abc123". When troubleshooting months later, you'll appreciate knowing which service uses which key.

Include dates for rotation. If you rotate keys periodically, include the date: "google202601" makes it clear when the key was created.

Keep names simple. Selectors must be DNS-safe. Stick to lowercase letters, numbers, and hyphens. Avoid special characters, spaces, or very long names.

Document your selectors. Maintain a list of which selectors belong to which services. This is invaluable when debugging deliverability issues or offboarding a service.

Multiple Selectors for the Same Service

Some services use multiple selectors for key rotation. Google Workspace, for example, uses "google" and "google2". Microsoft 365 uses "selector1" and "selector2".

This allows for seamless key rotation:

1. A new key is generated with the alternate selector
2. The service starts signing with the new key
3. After sufficient time for DNS propagation, the old key can be removed

When checking DKIM, make sure to test all active selectors for a service, not just one.

Troubleshooting Selector Issues

"No DKIM record found": Double-check the selector name. A typo or wrong selector is the most common cause. Verify the correct selector in your email service's admin console.

Selector works but DKIM still fails: The selector is correct, but there might be an issue with the key itself. Check if the key was rotated recently or if there's a DNS propagation delay.

Multiple selectors, only some work: This is normal during key rotation. Ensure your DNS has records for all active selectors your service uses.

Creating New DKIM Records

If you need to generate a new DKIM record with a custom selector, dkimcreator.com can help. You'll specify your selector name, and it will generate the public/private key pair for you to configure.

For most cloud email services, though, they handle key generation automatically—you just need to add their provided DNS record.

Monitor Your DKIM Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.