Check DKIM without knowing your selector
Most DKIM checkers make you enter a selector before they can look anything up, but many people don't know theirs. Our checker's auto-scan tries the selectors used by popular email providers automatically, so you can test your domain with nothing but the domain name. If you do know your selector (from the s= tag in a DKIM-Signature header), enter it for a direct lookup of selector._domainkey.yourdomain.com.
Common DKIM selectors by provider
| Provider | Typical selectors |
|---|---|
| Google Workspace / Gmail | |
| Microsoft 365 | selector1, selector2 |
| Mailchimp / Mandrill | k1, k2, k3, mandrill |
| SendGrid | s1, s2 |
| Postmark | pm |
| Proton Mail | protonmail, protonmail2, protonmail3 |
| Amazon SES | Three unique selectors generated per domain (shown in the SES console) |
A domain can publish several DKIM keys at once (one per sending service), and that's good practice. Each service signs with its own selector, and receivers verify whichever signature is present. After confirming your DKIM record, make sure DMARC ties it together: run a DMARC lookup to verify alignment.
DKIM checker FAQs
What is a DKIM record?
DKIM (DomainKeys Identified Mail) is an email authentication method that uses cryptographic signatures. The sending server signs each email with a private key, and the public key is published as a DNS TXT record so receivers can verify the signature.
What is a DKIM selector?
A DKIM selector is a string that identifies which DKIM key to use. The full DNS name is selector._domainkey.yourdomain.com, so one domain can publish several keys, for example one per email provider.
How do I find my DKIM selector?
Check your email provider's documentation, look at the DKIM-Signature header in a sent email (the s= value), or leave the selector empty and let the auto-scan detect it.
Can I check DKIM without knowing my selector?
Yes. Enter just your domain and the checker scans the common selectors from major providers (google, selector1, selector2, k1, s1, and more) and reports any DKIM keys it finds.
What key length should I use for DKIM?
Use at least 2048-bit RSA keys. 1024-bit keys still work but are considered weak by modern standards. Some providers also support Ed25519 keys, which are strong despite their short length.
How does DKIM relate to DMARC?
DMARC uses DKIM (and SPF) for email authentication. For DMARC to pass via DKIM, the domain in the DKIM signature (d=) must align with the From domain. Check your DMARC record to see your alignment settings.
Related tools
- DMARC checkerValidate your domain's DMARC record and see what to fix first.
- SPF checkerLook up SPF records with DNS lookup analysis.
- Create DMARC recordBuild a DMARC record with a live preview and publishing steps.
- Bulk DMARC & SPF lookupValidate DMARC and SPF records for up to 50 domains at once.
- What is DKIM?How DKIM signing and selectors work.