How to find a domain's DKIM selector (and why you can't list them all)

A DKIM key is published in DNS at a name made of two parts: a selector chosen by the sending service, and the fixed label _domainkey. To check a domain's DKIM you need the selector, and there is no DNS query that lists them. Here is how to find it, and why it matters for how you report DKIM to a client.

Method 1: read the email headers

The most reliable way. Get any real message from the domain (ask the client to send you one), open the original or raw source, and find the DKIM-Signature header:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=selector1; h=From:Date:Subject:Message-ID; bh=...; b=...

• s=selector1 is the selector.
• d=example.com is the signing domain. If this is not the client's domain (for example d=sendgrid.net), DKIM will not align for DMARC.

The public key is then at selector1._domainkey.example.com. A message can carry several signatures, one per service that signed it.

In Gmail use "Show original". In Outlook on the web, open the message, choose "View" and then "View message source". Both also show the Authentication-Results header, which tells you whether DKIM passed.

Method 2: provider defaults

Many services use a fixed or predictable selector. These are common ones as published by the providers:

Providers can and do change these, and admins can choose custom selectors. Treat the table as a starting point, not proof.

Method 3: DMARC aggregate reports

If the domain publishes DMARC with a rua address, the daily XML reports include each DKIM result with its domain and, in most reports, the selector. This is the best way to find every sender, including ones the client forgot about. See DMARC aggregate reports explained.

Checking the key once you have the selector

Look up the TXT record (following any CNAME) at <selector>._domainkey.<domain>. A valid key looks like v=DKIM1; k=rsa; p=MIIB.... Things to watch:

• An empty p= means the key has been revoked.
• A very short key (1024-bit or less) is weaker. Prefer 2048-bit where the provider supports it.
• A CNAME that points nowhere usually means DKIM was set up in DNS but never switched on at the provider, or the other way round.

Why "DKIM missing" is the wrong conclusion

Because selectors cannot be enumerated, an outside check can only try common ones. If none answer, the honest finding is "DKIM not found on common selectors", not "DKIM missing". The domain might sign with a custom selector you did not guess.

Hookgap works this way: it detects the mail provider from MX records, tries the selectors that provider is known to use plus a few common ones, and reports DKIM as found or "not found on common selectors". It never says missing. Confirm with Method 1 before telling a client anything firm.

Next steps

If DKIM is not set up for the main mail platform, start there: Microsoft 365 DKIM setup or Google Workspace DKIM and DMARC setup. Then work through every other sender found in the DMARC reports.