--- title: "DKIM Selector: What It Is & How to Find It | AutoSPF" description: "A DKIM selector is a label that points to one specific DKIM public key, letting a domain publish several keys - one per sending service. It forms the DNS h" image: "https://autospf.com/images/og-default.png" canonical: "https://autospf.com/dkim/dkim-selector/" --- # DKIM Selector A DKIM selector is a label that points to one specific DKIM public key, letting a domain publish several keys - one per sending service. It forms the DNS host selector.\_domainkey.yourdomain.com and appears as the s= tag in the DKIM-Signature header. This guide is part of our complete guide to [DKIM](/dkim/). Related: [the DKIM record](/dkim/dkim-record/) and [the DKIM signature](/dkim/dkim-signature/). **A DKIM selector is a short label that points to a specific public key stored in your domain’s DNS, letting a single domain publish many DKIM keys at once — one for each sending service or key generation — so receiving servers know exactly which key to fetch when they verify a given message’s signature.** ## How the selector fits into a DKIM lookup Every DKIM-signed email carries a selector inside its signature. The receiving mail server combines that selector with your domain to build a DNS hostname, then looks up the public key stored there. The convention is fixed: ``` selector._domainkey.yourdomain.com ``` The middle label `_domainkey` is always present — it is the namespace DKIM reserves in DNS. The selector is whatever the signing service chose. For example, if a message from `example.com` is signed with the selector `google`, the verifier queries: ``` google._domainkey.example.com ``` That hostname holds a TXT record containing the public key. The receiver fetches it, uses it to check the cryptographic signature on the message, and passes or fails DKIM accordingly. Because the selector is baked into each signature, the same domain can operate several keys side by side without collisions. ## How to find your DKIM selector The most reliable way to find a selector is to read it straight from a message that was actually signed by the service you care about. Open any received email from that sender, view the raw source or original headers, and locate the `DKIM-Signature` header. The `s=` tag is the selector: ``` DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=google; h=from:to:subject:date; bh=...; b=... ``` Here `d=example.com` is the signing domain and `s=google` is the selector, so the key lives at `google._domainkey.example.com`. A single message can carry more than one `DKIM-Signature` header — each one has its own `s=` tag, which is common when mail passes through multiple signing services. If you do not have a signed message handy, or you want to confirm what is actually published in DNS, use the auto-discovery in our free [DKIM lookup tool](/tools/dkim-lookup/). It probes the common provider selectors for your domain and returns the public keys it finds, so you can verify your DKIM setup without hunting through raw headers. ## Common selectors by provider Most email platforms use predictable, documented selectors. The signing service — not you — decides the selector name, so the value depends on who sends your mail: | Provider | Typical selector(s) | | ---------------- | -------------------------------------------------- | | Google Workspace | google | | Microsoft 365 | selector1, selector2 | | SendGrid | s1, s2 | | Mailchimp | k1 | | Amazon SES | generic tokens (a long unique string per identity) | These are conventions, not guarantees — a provider can change its scheme, and some let you customize the selector during setup. When in doubt, read the `s=` tag from a real signed message rather than assuming. ## Why domains have multiple selectors It is normal, and usually healthy, for one domain to publish several selectors at the same time. There are two main reasons. First, **each sending service gets its own selector.** If you send transactional mail through Amazon SES, marketing campaigns through Mailchimp, and internal mail through Google Workspace, each service signs with its own key under its own selector. They coexist in DNS without interfering with one another. Second, **key rotation relies on multiple selectors.** DKIM keys should be rotated periodically to limit the damage if a private key is ever exposed. During a swap, the old key stays live under its existing selector while the new key is published under a fresh selector. Mail signed with either key still verifies, and once all in-flight mail has cleared, the old selector can be retired. This is exactly why Microsoft 365 ships with `selector1` and `selector2` — it can flip between them cleanly. ## Choosing a selector when you set up DKIM When you generate a new key yourself, you pick the selector name. Any short, DNS-safe label works — teams often use something descriptive plus a date or version, such as `mail2026` or `smtp1`, so the purpose and vintage are obvious later. The name has no effect on security; it is simply a lookup key. What matters is that the selector in your DNS record matches the `s=` tag your signing system stamps on outgoing mail. For a full walkthrough, see [how to generate a DKIM record](/dkim/how-to-generate-a-dkim-record/). ## Frequently Asked Questions ### What is a DKIM selector? A DKIM selector is a text label that identifies which public key a receiving server should fetch to verify a signed message. It is combined with your domain as `selector._domainkey.yourdomain.com` to form the DNS lookup. Selectors let one domain publish multiple DKIM keys at once, one per service or key version. ### How do I find my DKIM selector? Open a message the service actually signed, view its raw source, and read the `s=` tag inside the `DKIM-Signature` header — that value is the selector. If you have no signed message on hand, the auto-discovery in our free DKIM lookup tool probes the common provider selectors for your domain and reports which keys are published. ### Can a domain have multiple DKIM selectors? Yes, and it is common. Each sending service typically signs with its own selector, so a domain using several mail platforms will publish several selectors simultaneously. Multiple selectors also enable safe key rotation: the old and new keys live under different selectors during the swap, so mail signed with either one still verifies. ### Does the DKIM selector name matter? The exact name has no effect on security or deliverability — a selector is just a lookup label. What matters is that the selector published in your DNS record matches the `s=` tag your signing service stamps on outgoing mail. Teams often add a date or version to the name so its purpose and age are easy to track. Rated 5/5 on G2 · Trusted since 2018 ## Trusted by 50,000+ domains ### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product" > It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. PJ Peter J. President · Small-Business (50 or fewer emp.) ### "Helped us go beyond capacity" > AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. VU Verified User Financial Services · Mid-Market (51-1000 emp.) ### "Great service and great support" > AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup. GF Greg F. Mid-Market (51-1000 emp.) [Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is a DKIM selector?","acceptedAnswer":{"@type":"Answer","text":"A DKIM selector is a text label that identifies which public key a receiving server should fetch to verify a signed message. It is combined with your domain as `selector._domainkey.yourdomain.com` to form the DNS lookup. Selectors let one domain publish multiple DKIM keys at once, one per service or key version."}},{"@type":"Question","name":"How do I find my DKIM selector?","acceptedAnswer":{"@type":"Answer","text":"Open a message the service actually signed, view its raw source, and read the `s=` tag inside the `DKIM-Signature` header — that value is the selector. If you have no signed message on hand, the auto-discovery in our free DKIM lookup tool probes the common provider selectors for your domain and reports which keys are published."}},{"@type":"Question","name":"Can a domain have multiple DKIM selectors?","acceptedAnswer":{"@type":"Answer","text":"Yes, and it is common. Each sending service typically signs with its own selector, so a domain using several mail platforms will publish several selectors simultaneously. Multiple selectors also enable safe key rotation: the old and new keys live under different selectors during the swap, so mail signed with either one still verifies."}},{"@type":"Question","name":"Does the DKIM selector name matter?","acceptedAnswer":{"@type":"Answer","text":"The exact name has no effect on security or deliverability — a selector is just a lookup label. What matters is that the selector published in your DNS record matches the `s=` tag your signing service stamps on outgoing mail. Teams often add a date or version to the name so its purpose and age are easy to track."}}]} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"DKIM","item":"https://autospf.com/dkim/"},{"@type":"ListItem","position":3,"name":"DKIM Selector","item":"https://autospf.com/dkim/dkim-selector/"}]} ``` ```json {"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Greg F."},"datePublished":"2023-07-26","reviewBody":"AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup.","name":"Great service and great support","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]} ```