DKIM Record Checker: How to Find Your Selector and Check Your DKIM Record

DKIM adds a digital signature to every email you send, and receiving servers check it against a public key published in your DNS. Unlike SPF and DMARC, you can't check DKIM with just your domain name: you need the selector, which tells you where the key lives. That's why so many DKIM checkers ask for two inputs. Here's how to get both and check the record yourself.

Step 1: Find your selector

The fastest way is from an email you've already sent. Send yourself a message, then view the raw headers:

• Gmail: open the message, click the three dots, then "Show original".
• Outlook: open the message, then File, Properties, and read the "Internet headers" box.
• Apple Mail: View, Message, All Headers.

Search for DKIM-Signature. It looks like this:

DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=google; ...

The value after s= is your selector (here, google). The value after d= is the signing domain. If d= shows your email provider's domain instead of yours, DKIM may pass but it won't count toward DMARC, more on that below.

Step 2: Look up the record

The key lives at selector._domainkey.yourdomain.com:

dig +short TXT google._domainkey.yourdomain.com

On Windows:

nslookup -type=TXT google._domainkey.yourdomain.com

A working result contains v=DKIM1 and a long p= value (the public key). Some providers, including Microsoft 365, publish a CNAME at that name that points to their own TXT record; that's normal, and dig will follow it.

Common selectors by provider

If you can't get a header, try the defaults:

• Google Workspace: google
• Microsoft 365: selector1 and selector2
• Mailchimp: k1
• SendGrid: s1 and s2
• Zoho: zoho
• Amazon SES and Postmark: unique per account; copy them from the provider's dashboard.

Each service that sends as your domain should have its own selector. Having several is normal.

Reading the result

• No record returned: the key was never published, the selector is misspelled, or your DNS host added your domain twice (you typed google._domainkey.yourdomain.com into a field that appends the domain automatically, creating ...yourdomain.com.yourdomain.com). Enter only google._domainkey as the host name.
• Record found but signatures fail: the p= value is often broken by a missing chunk, an extra space, or a line break when pasted. Copy it again from your provider in one piece.
• Empty p=: the key has been revoked on purpose.
• Record published but mail isn't signed: publishing the key does nothing until you turn signing on. In Google Workspace that's Admin console, Apps, Gmail, Authenticate email, Start authentication. In Microsoft 365 it's the DKIM page in Microsoft Defender's email authentication settings.

Why DKIM matters more in 2024 onward

Gmail and Yahoo require bulk senders to have SPF, DKIM, and DMARC, and they reject or spam-folder more unauthenticated mail from everyone else too. DKIM is also the authentication method that usually survives forwarding, which SPF doesn't. For DMARC to pass, the DKIM d= domain has to match your From domain, so turn on custom-domain signing in every tool that sends for you (newsletter, CRM, invoicing).

After you fix it

Send another test message and check the headers for dkim=pass under "Authentication-Results". When you rotate keys, publish the new selector first and keep the old one for a few days so mail already in transit still verifies.

Check it the fast way

Want a second opinion in under a minute? Scan your site free with SiteShield. It checks your SPF record and DMARC policy (the two DKIM partners you can check from your domain alone), plus HTTPS, security headers, and privacy basics and shows your score and every issue found. If you'd rather skip the trial and error, the $14 fix bundle gives you copy-paste fixes written for your exact site.

Check your site free