How to Find a DKIM Selector

The most reliable way to find a DKIM selector is in the DKIM-Signature header of a sent message. The value after s= is the selector. The value after d= is the signing domain. Query selector._domainkey.signing-domain.

Find it in a header

1. Send a message from the system to a mailbox you control.
2. Open the original message or full headers.
3. Find DKIM-Signature.
4. Copy the s and d values.
5. Enter both in the DKIM checker.

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=mail2026; ...
DNS name: mail2026._domainkey.example.com

Other places to look

Why guessing is unreliable

DKIM does not publish a selector directory. Selectors divide the key namespace and support multiple keys. Mailthentic tries a finite maintained list when no selector is supplied. No match does not prove DKIM is absent. Enter the exact header or provider value.

Public keys and signatures

The TXT record contains a public key, commonly in p=. A lookup confirms that a plausible record exists. It cannot verify a particular message without that message and signature.

Rotation and multiple selectors

Multiple selectors are normal for mail streams, regions, providers, or rotation periods. Publish a new public key before signing with it and retain the old key long enough for messages already in transit. An empty p= revokes a key.

Common errors

• Not found: use the signing domain from d=, not only the visible From domain.
• Wrong selector: copy s= exactly.
• Wrong location: publish beneath selector._domainkey.
• Broken TXT: check DNS quoting and line splitting.
• Old key removed: restore it during a transition if needed.

Check related SPF, DMARC, domain health, and MX signals separately.

Source

Selector and key behavior follows RFC 6376 and its listed updates. Last reviewed 2026-07-31.