What Is a DKIM Selector
Learn what a DKIM selector is, how to find it in headers, selector._domainkey DNS records, and key rotation.
Introduction
Selectors let a domain publish multiple DKIM keys — for rotation, different services, or provider changes without breaking all mail at once.
When troubleshooting DKIM, always check the selector from a real message header, not a guess.
Quick answer
A DKIM selector is a short name that identifies which DKIM public key receivers should look up in DNS. The selector appears in the DKIM-Signature header and in DNS at selector._domainkey.yourdomain.com.
What it means
The selector is paired with the signing domain (d=) in the DKIM-Signature header. Receivers query selector._domainkey.domain for the public key.
- s= tag in DKIM-Signature header is the selector
- DNS hostname: selector._domainkey.domain
- Providers may use selector1, google, k1 or custom names
- Multiple selectors can coexist during key rotation
- Record type may be TXT or CNAME depending on provider
Where you see this:
- Finding the correct DNS record during DKIM setup
- Key rotation with old and new selectors active
- Troubleshooting dkim=fail in message headers
- Multi-provider email with separate selectors
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; ...
DNS:
selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=..."Why this matters
Checking the wrong selector shows “record not found” even when DKIM is configured correctly under a different selector name.
How to check it
- Send a signed test message and open full headers.
- Find DKIM-Signature and note the s= (selector) and d= (domain) values.
- Run DKIM Checker with that selector.
- Confirm DNS at selector._domainkey.domain.
- Compare DNS value with provider admin panel.
Check DKIM selector
Use DKIM Checker with the selector from your provider or email headers.
Common mistakes
Checking wrong selector name
MediumDefault guess does not match provider selector.
Next step: Read s= from DKIM-Signature in real message headers.
Deleting old selector too early during rotation
MediumQueued mail may still sign with previous key.
Next step: Keep old selector until provider confirms rotation complete.
Selector record at wrong hostname
HighKey published without _domainkey suffix or wrong selector.
Next step: Use exact selector._domainkey.domain format.
TXT vs CNAME mismatch
MediumProvider expects CNAME but TXT was added, or vice versa.
Next step: Follow provider documentation for record type.
Example
google._domainkey.example.com CNAME google.domainkey.example.com.
; or
selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=..."Frequently asked questions
How do I find my DKIM selector?
Check your email provider admin panel or read the s= value in a DKIM-Signature header from a sent message.
Can I choose any selector name?
Usually your provider assigns it. Self-hosted mail may let you define custom selectors.
Why are there multiple selectors?
Common during key rotation or when different services sign mail for the same domain.
What if selector DNS is missing?
Receivers return DKIM none or fail, which can break DMARC alignment through DKIM.
Related tools
Use these free tools to verify your configuration after applying changes.
Related guides
Browse all Glossary guides →Need help applying this fix?
Send us your domain, report link or issue details. CheckDomainHealth will review the request and route it to the right technical team if hands-on support is needed.
Was this guide helpful?
Your feedback helps us improve our guides for everyone.
Thanks for your feedback!