DKIM record checker
Look up a DKIM record by selector - it cannot be discovered without one, since it is never published anywhere else.
1 · Input
The selector is chosen by whoever configured DKIM for the domain - common ones include "google", "selector1", "selector2", "default", or one supplied by an email service provider.
Related Tools
More tools in the same category
Other Tools
Popular tools from across A2Z
What DKIM does
DomainKeys Identified Mail attaches a cryptographic signature to outgoing email, generated with a private key the sending server keeps secret. A receiving server fetches the matching public key from DNS and verifies the signature - proving the message was sent by something with access to that private key, and that it was not altered in transit.
Why a selector is needed
Unlike SPF or DMARC, DKIM records do not live at a fixed, guessable name - they are published at selector._domainkey.domain, where the selector is chosen by whoever configured DKIM (an email provider's own name, a date, or an arbitrary string). Without knowing the selector, the record cannot be found; there is no way to enumerate it directly since it is not published anywhere else in DNS.
Finding a selector
The selector is usually visible in the DKIM-Signature header of an email actually sent by that domain (look for s=), or documented by whatever service sends the domain's mail - common ones include a provider's own name, "default", "selector1" and "selector2" (Microsoft 365's pair), or "google" (Google Workspace).
Related tools
DKIM alone does not decide what happens on failure - that is DMARC's job. See also SPF.
Rate this tool
Was this tool useful? Your feedback helps us improve it.