How to Find Your DKIM Selector: 3 Methods That Work

Your DKIM selector is the value after s= in the DKIM-Signature header of an email your domain sent. Send yourself a message from the mailbox, open the original headers, find the line starting DKIM-Signature, and read s= (the selector) and d= (the domain). The key then lives at selector._domainkey.domain in DNS.

Method 1: read it from a message header

1. Send a plain email from the mailbox you want to check to a Gmail address you control.
2. In Gmail, open the message, use the three dots menu and choose Show original.
3. Find the line starting DKIM-Signature. Read s=, for example s=google, and d=, for example d=example.com.
4. Look up the record at s._domainkey.d, here google._domainkey.example.com.

In Outlook on the web, open the message, choose the more actions menu, then View message source. In desktop Outlook, open the message in its own window and use File, Properties and read the Internet headers box. A message can carry more than one DKIM-Signature line, one from your domain and one added by a relay. Use the one whose d= matches your domain.

Method 2: ask your mail provider

• Google Workspace usually uses the selector google unless you set another when generating the key. The admin console's email authentication screen shows it.
• Microsoft 365 uses two selectors, selector1 and selector2, so it can rotate keys. Both are published as CNAME records, and the Defender portal shows them.
• Sending platforms and cold email tools usually show their own selector on the domain set-up screen when you add a sending domain.

Method 3: try common selectors

If you cannot send a test, you can look up common names: default, google, selector1, selector2, k1, s1, mail, smtp, dkim. Warmerly's free DKIM checker tries a long list of these when you leave the selector blank. A hit proves a key exists at that name. A miss proves nothing, because the real selector may simply be one nobody guessed. Use the header method if the guess fails.