DKIM selector finder with MailAuth Doctor
The domain check includes a DKIM probe. It is honest guesswork: it tests the well-known selector names of popular services and tells you how to find the rest.
- Enter your domain and run the check.
- Read the DKIM section: selectors found, the service they belong to, the key type and size.
- If yours is not listed, send yourself a message and open its headers.
- Look up the s= value from the DKIM-Signature header as s._domainkey.yourdomain.
What to know
A DKIM selector is the name a sender chooses for its public key, published at <selector>._domainkey.<domain>. There is no way to list all selectors of a domain from DNS, so a finder can only try names. This probe tests about 55 that popular services use, such as google, selector1 and selector2 (Microsoft 365), s1 and s2, k1 (Mailchimp), and generic names like default and dkim.
The reliable method is the message header. Send a message from the service you want to check, open "show original" or the raw headers, and find the DKIM-Signature line: s= is the selector and d= is the signing domain. Then query s._domainkey.d in DNS. Amazon SES and Postmark use per-customer names that cannot be guessed.
When a selector is found the tool reads the public key and reports its size. RFC 8301 requires verifiers to accept 1024-bit RSA keys but recommends signers use 2048 bits, and Gmail asks that DKIM keys be 1024 bits or longer. An empty p= means the key was revoked.
Updated · Cosmovex
Questions
How do I find my DKIM selector?
Read the s= tag of the DKIM-Signature header in a message sent from your domain. The key is published at that selector name under _domainkey.
Can a tool list every DKIM selector of a domain?
No. DNS cannot be enumerated for this, so a finder can only try known names. This one tries about 55.
What key size should DKIM use?
2048-bit RSA is recommended for signers. 1024-bit keys are still accepted, and Gmail requires at least 1024 bits.
What does an empty p= mean?
The key has been revoked, so signatures that use that selector will fail.
The free plan covers everything on this page. MailAuth Doctor Pro ($7/mo, billed monthly) is described on the MailAuth Doctor page.
