What is a DKIM selector?

A selector is the label a sender picks for each signing key, published at selector._domainkey.domain. The selector rides along in every signed message's DKIM-Signature header as the s= tag, which is how receivers know where to fetch the key.

How do I find out which selector a domain uses?

Open a message from the domain and view its headers: the s= tag in the DKIM-Signature header names the selector. Without a message, try common ones: google for Google Workspace, selector1 and selector2 for Microsoft 365, k1 for Mailchimp, s1 for SendGrid.

What key size should DKIM use?

1024-bit RSA keys are still accepted but considered weak; Google and Microsoft both recommend 2048-bit keys. Records that will not fit in a single TXT string are split into chunks, which resolvers reassemble, so 2048-bit keys work everywhere.

Look up DKIM records by selector

Confirm a signing key is published and see how strong it is.

What you get

Selector-based lookup

DKIM keys live at selector._domainkey.domain, so the tool takes both inputs and offers chips for the selectors major providers use.

Key strength estimated

The public key's approximate size is reported as 1024, 2048, or 4096 bits; Google and Microsoft both recommend at least 2048.

Revocation detected

A record whose p= tag is empty is a revoked key per RFC 6376, and the tool flags it instead of calling it valid.

Related tools

Need more than a demo?

Create a free account and get 100 API credits to use across every endpoint.

Start free Read the docs See pricing

Want the full power? See the full API

100 free creditsNo credit card

Look up DKIM records by selector

Selector-based lookup

Key strength estimated

Revocation detected

Continue enriching your data

SPF Checker

DMARC Checker

Email Deliverability Checker

MX Record Checker

Need more than a demo?