What is a DKIM selector, and where do you find it?
A DKIM selector identifies the public-identifier record used with a signing domain. A domain name alone is generally insufficient to know which selector an actual message used. Start with the sender’s setup instructions or the signature on a message you are authorised to inspect.
Open the relevant free tool →The selector locates the DNS record
Find the selector in the signature
A DKIM-Signature header includes tags describing the signature. The s tag provides the selector and the d tag provides the signing domain. Use those together for the DNS lookup. Do not assume the visible From domain is always the signing domain, and do not assume that every sender uses a selector named default.
Build the lookup name
The selector is combined with _domainkey and the signing domain. For an illustrative selector named mail2026 and signing domain example.com, the lookup name is mail2026._domainkey.example.com. This is a DNS lookup target, not an address to email. Follow the provider’s exact entries when setting up a real service.
Interpret the returned DNS record
A returned record can show whether public verification data is published at that name. A missing answer may mean the selector is wrong, the record was removed or DNS is not yet returning the intended configuration. A temporary lookup failure should remain distinct from an absent record. Some providers use DNS aliases as part of their documented setup.
Plan for rotation
A sender may update selectors when rotating keys. Keep the configuration history and use the selector from the message being investigated, not only the newest entry in an admin dashboard. An older message and a current message may legitimately reference different selectors. Avoid deleting old configuration without checking the provider’s rotation process.
Know what a DNS lookup does not prove
Finding a DNS record does not verify a message signature or establish DMARC alignment. Signature verification requires the relevant message data, and alignment requires comparing authenticated identities. Use the selector checker to inspect published configuration, then use trusted receiving-system results to diagnose an actual message. This keeps a helpful DNS result from turning into an unsupported claim that all mail from a domain is genuine.
Worked example
Illustrative header tags: d=example.com; s=mail2026;
Lookup: mail2026._domainkey.example.com