DKIM Selectors Explained: What They Are and How to Use Them

When you set up DKIM for your domain, you'll encounter something called a "selector." This short identifier is more important than it might seem—it's the key that allows you to use multiple DKIM keys for different email services while keeping everything organized.

If you've ever wondered why your Google Workspace DKIM record looks different from your Mailchimp DKIM record, or how you can have multiple DKIM keys active at once, selectors are the answer.

What is a DKIM Selector?

A DKIM selector is a text string that identifies which DKIM public key to use when verifying an email signature. Think of it as a label or name tag for each DKIM key you publish.

When an email arrives with a DKIM signature, the receiving server needs to find the corresponding public key in your DNS. The selector tells it exactly where to look.

The DNS Record Location

DKIM public keys are published as DNS TXT records at a specific location:

[selector]._domainkey.[yourdomain.com]

For example, if your domain is example.com and your selector is google, the DNS record would be at:

google._domainkey.example.com

Why Selectors Exist

Selectors solve several important problems:

1. Multiple Email Services

Most businesses use multiple services that send email on their behalf:

• Google Workspace or Microsoft 365 for regular email
• Mailchimp, HubSpot, or Klaviyo for marketing
• SendGrid or Postmark for transactional emails
• Zendesk or Freshdesk for support tickets

Each service needs its own DKIM key and selector. Without selectors, you could only have one DKIM key—which would mean only one service could sign emails for your domain.

2. Key Rotation

Security best practices recommend rotating DKIM keys periodically. Selectors make this possible without downtime:

1. Generate a new key with a new selector (e.g., key2)
2. Publish the new key in DNS
3. Update your email server to use the new key
4. Remove the old key after a transition period

During the transition, both keys can be active—emails signed with either will verify successfully.

3. Subdomain Separation

Some organizations use different selectors for different departments or purposes, making it easier to manage and audit email authentication.

Common Selector Examples

Different email services use their own selector naming conventions:

How Selectors Work in Practice

Step 1: Email is Sent

When your email service sends a message, it signs the email with its private DKIM key and adds a signature header that includes the selector:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google;
    h=from:to:subject:date:message-id;
    bh=abc123...;
    b=xyz789...

The s=google part is the selector.

Step 2: Receiving Server Queries DNS

The receiving mail server sees the selector and domain, then queries DNS for:

google._domainkey.example.com

Step 3: Key is Retrieved and Verified

The server retrieves the public key from DNS and uses it to verify the signature matches the email content. If everything checks out, DKIM passes.

Finding Your DKIM Selectors

To see which selectors are active for your domain:

Method 1: Check Email Headers

Send yourself an email from each service and examine the headers. Look for the DKIM-Signature header and find the s= parameter.

Method 2: Use MxToolbox

Use the MxToolbox DKIM Lookup tool. You'll need to know the selector to check—try common ones like google, selector1, k1, or default.

Method 3: Check Your DNS Records

Look at your domain's DNS records for any TXT records containing _domainkey. The subdomain prefix is the selector.

Selector Best Practices

Use Descriptive Names

When you create your own selectors (for custom implementations), use names that describe the purpose:

• marketing-2025 for marketing emails
• transactional for order confirmations
• support for help desk emails

Include Date or Version

Adding a date or version to selectors helps with key rotation:

• key-jan2025
• dkim-v2

Keep Track of All Selectors

Maintain a document listing all your active selectors, which service uses each one, and when keys were last rotated.

Don't Delete Old Selectors Too Quickly

When rotating keys, keep the old selector active for at least 24-48 hours after switching to the new one. This gives time for any in-flight emails to be delivered and verified.

Troubleshooting Selector Issues

DKIM Fails with "No Key Found"

This usually means:

• The selector in the email doesn't match any published DNS record
• The DNS record was deleted or has a typo
• DNS propagation hasn't completed (wait 24-48 hours)

Multiple Services, Some Failing

If one service's DKIM works but another fails, check that each service has its own unique selector and corresponding DNS record.

Selector Mismatch

If you configured a selector in your email service but DKIM fails, verify the selector name matches exactly (case-sensitive) between your service settings and DNS.

Selectors and DMARC

For DMARC to pass using DKIM, the signing domain (d= in the DKIM signature) must align with the From address domain. The selector doesn't affect DMARC alignment—it only determines which key is used.

This means you can have multiple selectors from different services, and as long as each service signs with your domain (not their own), DMARC will pass.

Related Resources

• What is DKIM? How Email Signatures Protect Your Domain
• How to Set Up DKIM: Complete Configuration Guide
• How to Fix DKIM Failures: Common Issues and Solutions
• Email Authentication: Complete Guide to DMARC, DKIM & SPF