Find which DKIM selectors a domain actually publishes.

DKIM fails when mail is signed with one selector and the key is published under another. This checker probes the selectors common providers use, or tests the exact selector you expect.

How it works

  • Without a selector, the tool probes common ones (`google`, `selector1`, `selector2`, `k1`, `s1`, `dkim`, `default`) over public DNS.
  • With a selector, it queries `selector._domainkey.yourdomain.com` directly for a `v=DKIM1` TXT record.
  • The found record is shown so you can confirm the key type and that the public key is present.

When to use it

  • When DKIM verification fails and you suspect a selector mismatch.
  • After rotating DKIM keys, to confirm the new selector resolves before the old one is removed.
  • When taking over a client domain and the signing configuration is undocumented.

Common failure cases

  • Assuming no DKIM exists because common selectors miss a custom one — check the actual selector from a message's DKIM-Signature header.
  • Removing the old selector's DNS record before all queued mail signed with it has delivered.
  • Publishing the key at `_domainkey.example.com` without the selector label.

Examples

What good and bad signals look like

Selector found

selector1._domainkey.example.com → v=DKIM1; k=rsa; p=MIIB…

The public key is resolvable under the selector the sending system signs with.

Selector mismatch

Mail signed with s=mail2024, but only selector1 resolves

Receivers cannot find the matching key, so DKIM verification fails for that mail.

What to do next

  • Generate a fresh keypair with the DKIM generator if no selector resolves.
  • Confirm the selector in your SMTP or ESP configuration matches the published one.
  • Run the full DNS checker to see DKIM alongside SPF, DMARC, and MX.
Wire DKIM checks into provisioning

GTM Inboxes provisions and verifies DKIM selectors as part of domain setup.

Related tools and workflows

DKIM key generator

Create a keypair and the matching selector record in-browser.

DNS & auth checker

Check the domain's full auth record baseline.

DMARC record lookup

See the policy that consumes DKIM alignment.

Cold email inbox calculator

Turn a DNS or authentication check into a conservative inbox-capacity plan.

FAQ

How do I find the selector my mail is signed with?

Open a delivered message's headers and look for the `s=` tag in the DKIM-Signature header. That selector is what receivers query — test exactly that value here.

Can a domain publish multiple DKIM selectors?

Yes, and it is normal: each sending service typically uses its own selector, and key rotation runs old and new selectors side by side.